# DF-4971 — mfip_detach leaks queued CAM ccbs and leaves a stale mfi_cam_start callback

`sys/dev/raid/mfi/mfi_cam.c:142-159` — `mfip_detach()` deregisters the bus
and frees the sim but (a) never drains `sc->mfi_sc->mfi_cam_ccbq` — ccbs the
SIM accepted via `mfip_cam_action` XPT_SCSI_IO (mfi_cam.c:242) but the
controller had no free command for — and (b) never clears
`sc->mfi_sc->mfi_cam_start` (set at mfi_cam.c:116). `xpt_bus_deregister`
cannot recover SIM-private ccbs (cam_xpt.c:4383 XXX), and `mfip_cam_action`
has no XPT_ABORT support, so the leaked ccbs hang forever; the still-live
parent controller's `mfi_startio` (invoked from `mfi_intr` at mfi.c:1245 and
from `mfi_shutdown`, both running after child deletion in
`mfi_pci_detach` mfi_pci.c:328-335) then pops them through the stale
callback and completes them via `xpt_done` on a deregistered bus
(`path->bus->sim == &cam_dead_sim`, cam_xpt.c:4456) with periphs already
destroyed — a CAM-state UAF shape; on `kldunload` the callback target is
unmapped module text.

## Files
- `mfip_detach_mirror.c` — choreography mirror: DFly CAM refcount semantics
  transcribed from cam_sim.c/cam_xpt.c + verbatim mfip_attach/action/start
  detach structure; stock vs fixed detach
- `build.sh`, `run.sh`, `build.log`, `run.log`, `run.2.log`
- `fix.diff` — drain + clear-callback fix
- `fix_build.log` — patched `mfip.ko` builds on the guest with `-Werror`
- `env.txt` — guest environment (no LSI MegaRAID HBA)

## Reproduce
```
sh build.sh && sh run.sh
```
Expected decisive lines (BUGGY mode):
```
post-detach: sim freed=1 bus sim=dead_sim queued-nonempty=YES mfi_cam_start=STALE (mfip_start)
V1 VIOLATED: 3 ccb(s) leaked in mfi_cam_ccbq ...
V2 VIOLATED: mfi_cam_start still set after sim freed
    [xpt_done] UAF: ccb 1 completed after its periph was destroyed (dispatch sim=0x... dead_sim)
    [mfip_start] UAF: call into unmapped module text after kldunload
BUGGY: 4 violation(s)   exit=1
```
FIXED mode: `FIXED: 0 violation(s)` `exit=0`.

Kernel-path reproduction is impossible on this guest (no LSI 0x1000 PCI
device; QEMU has no MegaRAID model) — see VERDICT.md.