# DF-4973 — dm_target_dmirror.c is non-compiling, unregistered dead code (no attack surface)

## Claim
`sys/dev/disk/dm/dmirror/dm_target_dmirror.c` (384 LOC) is a 2010-era scratch
file that was committed mid-thought. It:

* **cannot compile** — dozens of hard errors (verified by building the kmod on
  the audit guest, full log in `build.log`);
* is **not referenced by any build** — absent from `sys/dev/disk/dm/Makefile`
  `SUBDIR= linear striped crypt delay flakey` (dmirror/Makefile is an orphan
  kmod makefile), and has zero references in `sys/conf/`, `sys/config/`;
* **registers nothing** — every real dm target ends with
  `DM_TARGET_MODULE(...)` + `dm_target_insert()` (e.g.
  `sys/dev/disk/dm/linear/dm_target_linear.c`); this file has no module
  handler, no `dm_target_insert`, and no init/destroy/table/status/deps
  handlers at all (its own last line: `/* XXX: add missing dm functions */`).

Therefore the dm "dmirror" target has **zero runtime attack surface** on any
DragonFly system: no kernel or module built from this tree contains any of its
code, and no `dmsetup create … dmirror` table load can reach it (no registered
target named dmirror exists).

## Latent bugs (why this file must be deleted, not "finished")
If anyone ever made this compile, it would ship immediately-fatal bugs:

* `dm_target_dmirror_strategy()` default case dispatches the *same* bio twice
  to two different vnodes (`vn_strategy(priv->pdev[0]->pdev_vnode, &bp->b_bio1)`
  then `priv->pdev[1]` with the identical bio, dm_target_dmirror.c:376-377) —
  double completion → buf UAF;
* `m_disk = &config->disks[i]` with `i == config->ndisks` after the loop
  (dm_target_dmirror.c:295) — OOB index into `disks[4]`;
* `dmirror_write()` fan-out completes the parent bio once per mirror leg
  (`dmirror_write_done()` does `biodone(pop_bio(bio))` on both clones,
  dm_target_dmirror.c:135-137) — double biodone;
* placeholders throughout: `XXX config->ndisks` (:157, :251), `XXX disk1/disk2`
  (:174-175), `foo |= flag` (:186), `foo &= ~flag` (:196), `biodone(foo)`
  (:262), undeclared `nestbuf`/`next_disk`, undefined
  `SEGNO_FROM_OFFSET`/`SEGDESC_FROM_OFFSET`/`OFFSET_FROM_SEGNO` macros, and a
  redeclared `struct buf *bp` (:310) shadowing the function parameter.

## Reproduce
```sh
# on the audit guest (source tree at /usr/src):
cd /usr/src/sys/dev/disk/dm/dmirror && make        # → errors, exit 1
ls /boot/kernel/dm_target_dmirror* /boot/modules/dm_target_dmirror*   # → none
```

## Expected result
`make` fails with a wall of compile errors (`request for member … not a
structure or union`, `implicit declaration of …`, …) and produces no
`dm_target_dmirror.ko`; no such module exists in `/boot`. This **is** the
demonstration of the finding: the code is dead and cannot be loaded or
reached by any means, so none of its latent memory-safety bugs are
exploitable.

## Recommended fix
Delete `sys/dev/disk/dm/dmirror/` (the `.c`, the orphan `Makefile`, and
`dmirror_notes.txt` design notes — or move the notes to a docs area). The
dmirror design in `dmirror_notes.txt` should be re-implemented from scratch
with the dm-target registration discipline every other target follows.