# DF-4888

**iir_pci_attach error-path unwind: BAR0 (`io`) never released on any attach failure (release
commented out at iir_pci.c:349-352 and `rid` clobbered), and `bus_setup_intr` failure
(iir_pci.c:336-341) skips `iir_free()`/XPT teardown — leaving leaked DMA state, a live
`/dev/iirN`, registered CAM SIMs with no interrupt (CCBs hang forever; `iir_timeout` is empty
per DF-4176) and a stale shutdown handler.**

Hardware-gated finding (needs the Intel SRCZCRX / ICP RAID PCI card present with a failing
attach) — PoC not runnable on the audit guest: no such controller exists there
(`pciconf -lv` shows 6 devices, none 0x8086:0x0600 / 0x1119; see `env.txt`). The driver is
compiled into the guest kernel (`kldstat -v` → `100 pci/iir`).

Status: **untested** per the DF-4175 hardware-gated convention; code path verified by
inspection end-to-end (attach at iir_pci.c:176-354; unwind semantics of `iir_init`/`iir_free`/
`iir_attach` at iir.c:182-518).

Source citations in the pass-2 result block; full narrative in `VERDICT.md`; fix in `fix.diff`.