{
  "finding_id": "DF-4744",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Source-proven race, not runtime-demonstrable on this guest: ahci_pci_detach() (ahci_attach.c:580) clears AHCI_F_INT_GOOD, calls bus_teardown_intr() and then immediately kfrees every port (ahci.c:979) and unmaps the ABAR (ahci_attach.c:624). DragonFlys unregister_int() (kern_intr.c:416-497) unlinks and masks the vector but never drains a handler already executing on another CPU, so an ahci_intr() that passed the single flag check at ahci.c:2482 can walk kfreed sc_ports[] entries and read/write the unmapped register window \u2014 a hard-interrupt-context UAF acknowledged in-source by XXX interlock last interrupt? (ahci_attach.c:589). Trigger requires root (kldunload/devctl detach) or physical surprise-removal, and the audit guest has no AHCI controller at all (pciconf: no class 0x0106 device, storage is virtio \u2014 env.txt), so no run was possible; hence untested/reproduced=0 rather than any reproduced claim.",
  "exploit_chain": "",
  "evidence": "VERDICT.md carries the full interleaving trace (CPU0 detach steps :592/:597/:604/:624 vs CPU1 handler body ahci.c:2484-2501), the teardown-chain proof (pci_teardown_intr sys/bus/pci/pci.c:3384 -> unregister_int kern_intr.c:416 with no drain), the hardware-absence proof (env.txt), and the instrumented-kernel reproduction recipe for real iron (\u00a73). trigger_devctl_detach.sh encodes the exerciser; fix.diff is the proposed interlock.",
  "kernel_refs": [
    "sys/dev/disk/ahci/ahci_attach.c:589",
    "sys/dev/disk/ahci/ahci_attach.c:592",
    "sys/dev/disk/ahci/ahci_attach.c:596",
    "sys/dev/disk/ahci/ahci_attach.c:604",
    "sys/dev/disk/ahci/ahci_attach.c:624",
    "sys/kern/kern_intr.c:416",
    "sys/dev/disk/ahci/ahci.c:2472",
    "sys/dev/disk/ahci/ahci.c:2482",
    "sys/bus/pci/pci.c:3384",
    "sys/dev/disk/ahci/ahci.c:979"
  ],
  "poc_changes": "No seed PoC existed; none could be built \u2014 the target code path (ahci_pci_detach) is unreachable on the audit guest (no AHCI controller). A hardware exerciser script and an instrumented-kernel recipe were authored instead and clearly marked NOT RUN.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 depth items checked and killed are listed in VERDICT.md \u00a71 (all attach-failure unwinds, port-thread stop semantics, MSI release on early failure, partial DMA-tag unwind, port-map bit walk, per-port sysctl removal-before-free, probe class bypass quirk). Adjacent-file observation: ahci_init leaks its temporary ap on bus_space_subregion failure (ahci.c:186/197) \u2014 ahci.c scope, boot-time-only, not filed. Trigger is privileged/physical only, so no uid0 chain exists for this bug class.",
  "recommended_fix": "Drain in-flight handlers before freeing ports: add an sc_intr_active counter (inc, re-check AHCI_F_INT_GOOD, dec+wakeup) around ahci_intr()s body and have ahci_pci_detach() mfence+wait for the count to hit zero after bus_teardown_intr(); longer term give unregister_int() a real drain like FreeBSDs intr_event teardown.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (driver-side active-handler interlock with cpu_mfence + drain wait in ahci_pci_detach) was authored from the line-accurate root cause but could not be validated: with no AHCI controller on the guest there is no baseline behavior to compare against, and a kernel rebuild would prove nothing the source trace does not.",
  "fix_evidence": "findings/poc/DF-4744/fix.diff (three-hunk proposal: ahci.h softc fields, ahci_intr() in-flight counting with flag re-check, ahci_pci_detach() drain wait before port frees)."
}