# DF-4706 — amr_pci_attach registers amr_pci_intr before the state it
# consumes exists → NULL function-pointer call from a shared-line IRQ

## What
`sys/dev/raid/amr/amr_pci.c:263-268` — `bus_setup_intr(..., amr_pci_intr,
sc, ...)` is called **before** everything the handler consumes exists:

- `sc->amr_get_work` is assigned only inside `amr_attach()`
  (`amr.c:206-216`), which runs at `amr_pci.c:346`;
- the softc locks are `lockinit`'d at `amr_pci.c:324-325`;
- the mailbox/sg/ccb DMA blocks are allocated at
  `amr_pci.c:326/334/338`.

`amr_pci_intr` (`amr_pci.c:461-470`) does **no** interrupt-status check
and **no** state gate — it unconditionally calls `amr_done(sc)`, whose
first action is the indirect call `sc->amr_get_work(sc, &mbox)`
(`amr.c:1782`). The IRQ was allocated `RF_SHAREABLE`
(`amr_pci.c:257-258`), so the handler is invoked for **any** device
sharing the line, not just the AMR card.

## Consequence
Any interrupt on the shared IRQ line during the attach window
(`bus_setup_intr` … `amr_attach`'s pointer assignment) — e.g. a NIC on
the same legacy INTA line, or the card itself left asserting by
firmware/previous driver instance — executes `amr_pci_intr` →
`amr_done` → indirect call through the NULL `sc->amr_get_work`
→ jump to address 0 → kernel panic at boot or `kldload amr`.

Distinct from known DF-1820 (teardown ordering: `amr_pci_free` tears
the interrupt down LAST while freeing DMA) — this is the *setup* side
of the same missing interrupt-lifecycle discipline: registered too
early, gated by nothing.

## Reachability / gating
Requires LSI MegaRAID/amr PCI hardware (probe must match
`amr_device_ids[]`). The trigger is probabilistic (an unrelated
device's interrupt must land in a millisecond-scale window), or
deterministic with an amr card that asserts IRQ before INTEN.
QEMU does not emulate LSI MegaRAID — verified absent on the audit
guest (no 0x101e/0x1000:1960 PCI device, `/dev/amr*` absent), so this
is hw-gated `inconclusive`.

## Conceptual trigger (needs hardware)
```
# device sharing the IRQ line with the amr card generates traffic;
# repeat kldload in a loop to widen the window:
while :; do kldload amr; kldunload amr; done
# expected on hit: panic "Fatal trap 12/... calling 0x0" from
#   amr_pci_intr -> amr_done -> sc->amr_get_work
```

## Fix
Register the interrupt AFTER `amr_attach()` succeeds (and/or gate the
handler on `AMR_STATE_INTEN`), see `fix.diff`.