{
  "finding_id": "DF-5012",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Sink-level reproduction on the stock guest kernel (DF-4986 house precedent): a kld module whose d_strategy contains the verbatim completion pattern of mfi_disk_strategy()s hw_crit_error/issuepend_done early returns (b_error=EBUSY; return 0; no B_ERROR, no b_resid, no biodone) wedged the issuing process in an unkillable D-state (D3/physstr) that survived SIGKILL, and it terminated only when an external completion (biodone) was injected -- exactly the driver-side omission of sys/dev/raid/mfi/mfi_disk.c:266-274. The mfi-specific entry (controller->hw_crit_error set at mfi_tbolt.c:1222/1288; issuepend_done==0 for the whole OCR window, mfi_tbolt.c:541..1323) is hardware-gated on this guest (no MegaRAID controller) and is unconditional control flow in the source. Impact ceiling: dos - permanent unkillable hang for any issuer with a bio in flight when the controller faults or resets; whole-system wedge when mfid carries root.",
  "exploit_chain": "",
  "evidence": "run.log lines == ps before kill == through GONE (PID 1109 D3/physstr survives kill -9, dies only after the poke completes the leaked bio); dmesg.txt df5012: LEAKING bio ... NO biodone + poke -- completing leaked bio; df5012.c:81-92 is the verbatim pattern; VERDICT.md has the full source trace",
  "kernel_refs": [
    "sys/dev/raid/mfi/mfi_disk.c:266",
    "sys/dev/raid/mfi/mfi_disk.c:271",
    "sys/dev/raid/mfi/mfi_disk.c:257",
    "sys/dev/raid/mfi/mfi.c:2901",
    "sys/dev/raid/mfi/mfi_tbolt.c:541",
    "sys/dev/raid/mfi/mfi_tbolt.c:1222",
    "sys/dev/raid/mfi/mfi_tbolt.c:1323"
  ],
  "poc_changes": "authored fresh from source analysis (no seed); module self-cleans via a recovery-poke offset so the guest is left clean",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 75,
  "guest_dirty": 0,
  "build_cmd": "cd /tmp/poc/df5012 && make && cc -O -o /tmp/poc/df5012_trigger /tmp/poc/df5012_trigger.c",
  "run_cmd": "kldload /tmp/poc/df5012/df5012.ko; /tmp/poc/df5012_trigger wedge /dev/df50120 & kill -9 <pid>; /tmp/poc/df5012_trigger poke /dev/df50120; kldunload df5012",
  "code_hash": "1d110800161420943a6e788a109765e922b3ff4b9a775d453128206ebb6ebd44",
  "notes": "Systemic twin of DF-2066 (mfi_syspd.c, identical pattern); mfi_disk.c had no pass-1 findings, this is a new file-scoped defect. Sink reproduction proves the pattern is sufficient for a permanent unkillable D-state on this exact kernel; full hardware trigger requires a MegaRAID controller (absent from guest).",
  "recommended_fix": "On both early-return paths in mfi_disk_strategy(), complete the bio: set B_ERROR, b_resid = b_bcount, and call biodone() (goto fail label), mirroring the NULL-si_drv1 path 9 lines above.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff (git apply --check clean) completes the bio on both paths. Single-fix kernel build not performed: the mfi entry path is hardware-gated on this guest, so a patched kernel could not exercise the trigger; the sink demo establishes the failure mode the fix removes.",
  "fix_evidence": "fix.diff in this directory; VERDICT.md Fix section"
}