{"finding_id":"DF-4954","status":"untested","attempts":0,"reproduced":0,"impact":"leak","confidence":"certain","verdict":"Hardware-gated (no MPT3 HBA on guest): bus_setup_intr failure sets msi_msgs=i BEFORE releasing the just-allocated q->irq for queue i - every teardown loop iterates i<msi_msgs so that resource is never released, and the subsequent pci_release_msi hits rle->res!=NULL -> EBUSY (ignored), so the MSI message leaks too. Rman resource + vector exhaustion on attach-error/retry paths. Release-before-break fix (mirrors upstream mps/mpr).","exploit_chain":"attach-time bus_setup_intr failure under irq/vector pressure -> truncated msi_msgs skips queue i in every teardown -> IRQ rle + MSI message leaked for the device lifetime, blocking re-attach","evidence":"findings/poc/DF-4954/ (this verdict; code-trace proof)","kernel_refs":["sys/dev/raid/mpr/mpr_pci.c:294","sys/dev/raid/mpr/mpr_pci.c:302-309","sys/dev/raid/mpr/mpr_pci.c:340-348","sys/dev/raid/mpr/mpr_pci.c:361-362","sys/bus/pci/pci.c:2094-2096"],"guest_uname":"","code_hash":""}