# DF-5012 — VERDICT

**Status:** REPRODUCED at sink level on the stock audit guest (the exact
completion pattern of mfi_disk.c:266-274 demonstrated live); the mfi-specific
entry conditions (`hw_crit_error`, `issuepend_done == 0`) are hardware-gated
(no MegaRAID controller on this guest) and are unconditional control flow in
the source — line-traced below.

**Impact ceiling:** dos — permanent unkillable D-state for any issuer with a
bio in flight when the controller faults or resets (OCR). Whole-system hang
when mfid carries the root filesystem.

## Why the bio leaks (source trace)

1. `mfi_disk_strategy()` mfi_disk.c:249: bios arrive from the disk layer
   (`dev_dstrategy` on the mfid cdev or its slices).
2. mfi_disk.c:266-269: `if (controller->hw_crit_error) { bp->b_error = EBUSY;
   return (0); }` — no `bp->b_flags |= B_ERROR`, no `bp->b_resid`, **no
   `biodone(bio)`**. The caller of a d_strategy owns completion; nobody else
   holds a reference to this bio. It is leaked into nothing.
3. mfi_disk.c:271-274: identical for `controller->issuepend_done == 0`.
   `issuepend_done` is a per-controller OCR gate: cleared at
   mfi_tbolt.c:541 when the reset starts, restored at mfi_tbolt.c:1323 when
   it finishes — the window is the entire OCR (seconds).
   `hw_crit_error` is set at mfi_tbolt.c:1222/1288 on fatal PCI/firmware
   access failure during adapter reset and is never cleared until reattach
   (mfi.c:388).
4. The issuer (e.g. `physio` → `biowait`) sleeps uninterruptibly forever.
   Contrast the correct pattern 9 lines up (mfi_disk.c:257-263) and the
   userspace-facing ioctl gate that *does* return EBUSY (mfi.c:2901-2904).

## Guest run (stock kernel, no config changes)

```
+ ps -o pid,stat,wchan,command -p 1109
   PID STAT   WCHAN    COMMAND
  1109 D3     physstr  /tmp/poc/df5012_trigger wedge /dev/df50120
+ kill -9 1109
+ ps ...          # after SIGKILL, 2 seconds later
  1109 D3     physstr  ...          # STILL ALIVE
+ /tmp/poc/df5012_trigger poke /dev/df50120   # external completion
poke: pread@1M r=512 errno=0
+ ps ...  ->  GONE
```
dmesg: `df5012: LEAKING bio 0xfffff8004f3dfcc0 (off 2097152) -- b_error=EBUSY,
return 0, NO biodone` then `df5012: poke -- completing leaked bio ...`.

The wedge process survived `SIGKILL` and terminated only when the leaked bio
was completed externally — i.e. the driver-side omission alone is sufficient
for the permanent hang. That is precisely the mfi_disk.c:266-274 behavior.

## Why not a full hardware trigger

No MegaRAID controller exists on the guest (`pciconf -l` has no LSI 1000:1960
etc.), and mfi cannot be attached without one. QEMU does ship a `megasas`
device model, but the guest VM is booted from a fixed snapshot with a fixed
device set; per the DF-2066 precedent (identical bug, sibling file), the
source trace above is the standard of proof for HW-gated driver findings.

## Exploit chain
Not applicable (dos class). The primitive is a permanent, unkillable kernel
sleep, not memory corruption.

## Fix
`fix.diff`: complete the bio on both paths (B_ERROR + b_resid + biodone)
via a `fail:` label — the same pattern the NULL-si_drv1 path already uses.
Validated `git apply --check` against the audit tree; not built as a
single-fix kernel (dos-class, HW-gated entry).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.