{
  "finding_id": "DF-5026",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Sink-level reproduction on the stock guest kernel (DF-4986/DF-5012 house precedent): a raw D_DISK device wired to the verbatim ipsd_strategy (ips_disk.c:128-143) + ips_start_io_request (ips_commands.c:238-253) structure demonstrates that once the adapter is IPS_OFFLINE (set by ips_timeout after a failed reinit, ips.c:354-358; ips_get_free_cmd then returns EIO, ips.c:207-209), every bio is parked in bio_queue forever: the error code is swallowed at ips_commands.c:246-247 and ipsd_strategy has no fail-fast, so no biodone() ever fires. The issuing process landed in D3/physstr (biowait), SURVIVED kill -9, and was released only by an external drain (the poke) -- 7 bios parked from a single pread, and 6 more accumulated from incidental IO during the seconds before unload (unbounded queue growth). With the fix pattern transplanted into the sink (strategy fail-fast + start_io_request draining on terminal error) the same pread returns immediately r=-1 errno=5 (EIO): no D-state, no residual process. The real ips entry is hardware-gated on this guest (no ServeRAID adapter, env.txt) but the completion pattern is driver-side unconditional control flow; impact ceiling is a permanent unkillable-hang DoS for every issuer (whole-system wedge when ipsd carries root) whenever the hardware faults or is made to fault.",
  "exploit_chain": "",
  "evidence": "run.log PID 1275 D3 physstr + survives kill -9 + gone only after poke -- draining 7 parked bio(s) with EIO; dmesg tail df5026: unload -- draining 6 parked bio(s) (continued accumulation); run_fixed_ab.log wedge: pread@2097152 r=-1 errno=5(Input/output error) + no wedge process remains (fixed pattern)",
  "kernel_refs": [
    "sys/dev/raid/ips/ips_disk.c:128",
    "sys/dev/raid/ips/ips_disk.c:138",
    "sys/dev/raid/ips/ips_disk.c:140",
    "sys/dev/raid/ips/ips_commands.c:243",
    "sys/dev/raid/ips/ips_commands.c:246",
    "sys/dev/raid/ips/ips.c:207",
    "sys/dev/raid/ips/ips.c:220",
    "sys/dev/raid/ips/ips.c:354"
  ],
  "poc_changes": "authored fresh from source analysis (no seed); control offsets muxed in front of the verbatim strategy (DF-5012 style) so the demo self-drives and the guest returns to a clean state; unload hook drains anything still parked",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 200,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh (make KMOD df5026 + cc df5026_trigger.c) on the guest",
  "run_cmd": "sh run.sh (wedge + kill -9 + poke); sh run_ab.sh (A/B original vs fixed pattern); kldunload df5026",
  "code_hash": "c51d993ab9b88cf5db990531d1b8838f5e1b60e7be460ab3ca58f766e855a19d",
  "notes": "ips instance of the systemic DF-2066/DF-5012 missing-biodone family (filed against ips_disk.c whose strategy lacks the fail-fast; the swallowed error sits in ips_commands.c:246-247 and the fix spans both). ips.c/ips_commands.c were pass-1 audited with no finding covering this path. EBUSY retry-on-busy semantics are deliberately preserved by the fix; only terminal EIO drains.",
  "recommended_fix": "ipsd_strategy: fail-fast (B_ERROR/EIO/b_resid/biodone) when sc->state & IPS_OFFLINE; ips_start_io_request: distinguish ips_get_free_cmd errors -- keep returning on EBUSY (transient, retried on next completion) but drain-and-fail every queued bio with the error on terminal EIO (fix.diff).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "Behavioral A/B at sink level (run_fixed_ab.log): baseline pattern wedges unkillably (D-state survives SIGKILL); fixed pattern returns EIO immediately with no residual process. fix.diff also compile-validated against the guests /usr/src copy: full ips.ko module rebuilt with -Werror clean (fix_validation.log; sources restored). The real ips entry path is hardware-gated on this guest; the demonstrated failure mode and its removal are properties of the driver-side completion pattern.",
  "fix_evidence": "run_fixed_ab.log (A/B: SURVIVES SIGKILL (original pattern) vs r=-1 errno=5 ... no wedge process remains (fixed pattern)); fix_validation.log (patched ips.ko -Werror clean); fix.diff"
}