# DF-5026 — ips: bios queued to an offline adapter are never completed (ips_disk.c)

**File:** `sys/dev/raid/ips/ips_disk.c` (pass 2, with the swallowed error in
`sys/dev/raid/ips/ips_commands.c:246-247`)
**Lines:** ips_disk.c:128-143 (strategy, no fail-fast),
ips_commands.c:246-247 (error swallowed), ips.c:207-209/220 (EIO/EBUSY
sources), ips.c:354-358 (IPS_OFFLINE set after failed reinit)
**Class:** missing-completion DoS — the ips instance of the DF-5012/DF-2066
systemic pattern.

## Build (guest, root)

```
sh build.sh
```

## Run

```
sh run.sh          # original pattern: wedge + kill -9 + poke
sh run_ab.sh       # A/B: original vs fixed pattern
```

## Expected output (decisive lines from run.log)

```
   PID STAT   WCHAN    COMMAND
  1275 D3     physstr  /tmp/poc/df5026_trigger wedge /dev/df50260
-- after SIGKILL, still present? --
  1275 D3     physstr  ...            <-- survives kill -9
df5026: poke -- draining 7 parked bio(s) with EIO
gone                                 <-- released only by external completion
```

And from run_fixed_ab.log (FIXED pattern):

```
wedge: pread@2097152 r=-1 errno=5(Input/output error)   <-- immediate EIO
no wedge process remains (fixed pattern)
```

## Mechanism

`ips_timeout()` (ips.c:354-358) declares the adapter `IPS_OFFLINE` after a
failed forced reinit ("AIEE! adapter reset failed"). From then on
`ips_get_free_cmd()` returns EIO (ips.c:207-209) — but
`ips_start_io_request()` discards the error code entirely
(ips_commands.c:246-247) and returns, leaving the bio on `sc->bio_queue`
forever; `ipsd_strategy()` (ips_disk.c:134-141) keeps accepting and
enqueuing new bios with no fail-fast. No `biodone()` ever fires: every
issuer (including fs-flush on close) parks in uninterruptible biowait, and
`bio_queue` grows without bound. The unload-time observation in run.log
("draining 6 parked bio(s)" AFTER the poke drained 7) shows the queue keeps
accumulating from incidental IO while offline.

## Why a sink module

Guest has no ServeRAID adapter (env.txt). Per the DF-4986/DF-5012 precedent,
`df5026.c` wires the verbatim `ipsd_strategy`/`ips_start_io_request`
structure (lock, bioqdisksort, swallow-on-error) to a raw D_DISK device;
"offline" reproduces `IPS_OFFLINE`. The D-state/unkillable/external-release
behavior demonstrated is exactly the failure mode the driver-side omission
inflicts.

## Artifacts

`df5026.c`, `df5026_fixed.c` (fix pattern), `df5026_trigger.c`, `Makefile`,
`build.sh`, `run.sh`, `run_ab.sh`, `build.log`, `run.log`,
`run_fixed_ab.log`, `env.txt`, `fix.diff`.