# DF-5025 Verification Verdict

**Status: not_reproduced** (hardware-gated entry + privileged trigger;
source-chain certain, runtime exercise impossible on this guest)

## What is certain (code)

* `ipsd_open` sets `IPS_DEV_OPEN` with no lock (ips_disk.c:92);
  `ipsd_detach` tests it with no lock (ips_disk.c:211). Nothing on the
  open→detach path serializes them — a textbook TOCTOU.
* On losing the race, detach completes `disk_destroy` (:214) while an fd is
  open; devfs retains the cdev until last close, so `ipsd_close` later runs
  `dsc->state &= ~IPS_DEV_OPEN` (:103) on the newbus-freed
  `ipsdisk_softc_t` → use-after-free write. Reference chain:
  subr_disk.c:876→527-548 (disk_destroy), kern_conf.c:345-354 (destroy_dev),
  devfs_core.c:1440-1459 (release_dev), ips.c:304-319 (diskdev free).
* `ipsd_close` itself lacks the `si_drv1` NULL check its open twin has
  (compare :90-91 vs :101-103).
* In-flight-bio variant: `ips_adapter_free`'s `used_commands` gate
  (ips.c:533-537) does not cover queued-but-unstarted bios; those are
  abandoned (DF-5026) referencing a softc about to be freed.

## Why it cannot be exercised here

* Guest has no IBM ServeRAID adapter (env.txt probe: no vendor 0x1014/0x9005
  PCI devices, no /dev/ips*, no ipsd disks) — the ips driver code is
  compiled into the guest kernel (`kldstat -v` shows ids `ips/ipsd`,
  `pci/ips`) but attach never runs without hardware.
* The only detach initiators are privileged (kldunload / PCI bus detach),
  so even with hardware the trigger requires root — this caps severity at
  Low (contrast DF-5013, whose mfi AEN offline path was unprivileged).

## Fix validation

`fix.diff` mirrors the verified DF-5013 mfi fix (DISABLED flag + in-flight
drain + lock-serialized state + close NULL check). It compile-validates as
part of the merged patched ips.ko build (`-Werror` clean, see DF-5026 pack /
fix_validation.log). Behavioral validation hardware-gated → fix_status
not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.