# DF-5026 Verification Verdict

**Status: reproduced (sink-level, house precedent DF-4986/DF-5012) — impact dos**

## Reproduced

`run.log` (original pattern, stock guest kernel, uname in env.txt):

1. Adapter taken "offline" (simulating ips_timeout's failed reinit,
   ips.c:354-358).
2. A single `pread` parks its bio(s): issuing process lands in
   `D3/physstr` (biowait) — PID 1275.
3. `kill -9` delivered → **process still present 2 s later** (unkillable
   D-state).
4. Recovery poke drains the parked bios with EIO → process exits
   immediately ("gone").
5. The unload log line ("draining 6 parked bio(s)" after the poke's 7)
   demonstrates continued accumulation: every bio arriving while offline
   parks; none are ever completed by the driver pattern itself.

`run_fixed_ab.log` (A/B): with the fix pattern (strategy fail-fast +
`ips_start_io_request` draining on terminal error), the same `pread` returns
**immediately** `r=-1 errno=5 (EIO)` — no D-state, no residual process.

## Source chain (cited)

* ips_disk.c:128-143 — `ipsd_strategy` enqueues unconditionally; no
  IPS_OFFLINE/IPS_TIMEOUT gate.
* ips_commands.c:246-247 — `if (ips_get_free_cmd(sc, &command, 0) != 0)
  return;` — the error code (EIO offline / EBUSY busy-or-resetting) is
  discarded; EBUSY-retry is correct behavior, EIO is terminal.
* ips.c:207-209 (EIO when OFFLINE), ips.c:220 (EBUSY when TIMEOUT),
  ips.c:137 & ips.c:358 (IPS_OFFLINE setters).

Impact ceiling: with a filesystem on ipsd, every page-in/write/fsync parks —
local DoS that wedges the box (and root-on-ipsd = whole-system hang);
attacker-relevant when the hardware faults or is made to fault (malicious
device / broken HBA). Bucket: base:dev (same as DF-5012/DF-2066 twins).

## Fix validation

* Behavioral: A/B above — the fixed pattern removes the wedge entirely
  (fix_baseline_reproduced=true, fix_patched_reproduced=false).
* Compile: `fix.diff` (ips_disk.c fail-fast + ips_commands.c drain)
  applied to the guest's /usr/src copy; full ips.ko module rebuilt
  `-Werror` clean (fix_validation.log). Sources restored afterward.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.