# DF-5027 Verification Verdict

**Status: not_reproduced** (hardware-gated crash-dump path; code chain
deterministic — stub poll + zeroed status + unchecked completion)

## Source proof

* ips.c:232 — `ips_get_free_cmd` bzeroes `command->status` on handout.
* ips.c:810-814 — `ips_copperhead_poll`: "cmd polling not implemented for
  copperhead devices" — kprintf and return; the issued dump command is
  never completed, `ipsd_dump_block_complete` (ips_disk.c:326-336) never
  runs, the data map is never unloaded.
* ips_disk.c:261-264 — the ONLY post-issue check is
  `COMMAND_ERROR(&command->status)` on that still-zeroed status → always
  false → every 64K chunk "succeeds"; `command->completed` is never
  consulted.
* Follow-on: ips_disk.c:256-257 re-loads an already-loaded dmamap on the
  next loop iteration (bus_dma(9) undefined behavior).

Distinction from known findings: DF-4616 covers the morpheus poll window
being 10x too short (ips.c timing bug); this finding is the copperhead
complete no-op plus ipsd_dump's missing completion check — different
adapter, different file, different failure (false success vs short wait).

## Not exercisable on this guest

No IBM ServeRAID adapter (env.txt: no 0x1014/0x9005 PCI devices, no
/dev/ips*, no ipsd disks); the dump path additionally requires a crash.
The defect is unconditional control flow, hence confidence certain in the
code; runtime reproduction hardware-gated.

## Fix validation

`fix.diff` (completed-flag handshake) compiled clean as part of the patched
ips.ko module build (`-Werror`, fix_validation.log). Behavioral validation
hardware-gated → fix_status not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.