# DF-5043 — VERDICT

**Verdict:** REPRODUCED (runtime replay of verbatim driver code; HW-gated natural trigger)
**Class:** resource leak (CWE-772)
**Impact ceiling:** none (pinned IRQ resource per failed attach)
**Confidence:** certain

## Reproduction

Same harness as DF-5042 (see `../DF-5042/VERDICT.md` for the technique).
Mode 2 (`kenv df5042.irqfail=1`): the verbatim `adv_pci_attach()` reaches the
interrupt stage; `fk_bus_alloc_resource` hands out a fake IRQ resource and
records it; `fk_bus_setup_intr` returns failure; the adv_pci.c:289-294 unwind
calls `adv_free()` and `bus_release_resource(dev, SYS_RES_IOPORT, ...)` only.
Observed in `run.log`:

```
FK: bus_alloc_resource(IRQ) -> fake irq resource 0xffffffff82606820
FK: bus_setup_intr -> scripted FAILURE
FK: bus_release_resource(IOPORT)
DF5042: bus_release_resource: IOPORT=1 IRQ=0; bus_setup_intr calls=1
DF5042: *** IRQ resource NEVER RELEASED on the bus_setup_intr failure unwind -- DF-5043 LEAK PROVEN ***
```

## Mechanism (source-confirmed)

adv_pci.c:287-294:

```c
irqres = bus_alloc_resource(dev, SYS_RES_IRQ, &irqrid, 0, ~0, 1,
			    RF_SHAREABLE | RF_ACTIVE);
if (irqres == NULL ||
    bus_setup_intr(dev, irqres, 0, adv_intr, adv, &ih, NULL)) {
	adv_free(adv);
	bus_release_resource(dev, SYS_RES_IOPORT, rid, iores);   /* only IOPORT */
	return ENXIO;
}
```

When `bus_alloc_resource` succeeded but `bus_setup_intr` failed, `irqres` is
never released (`SYS_RES_IRQ`, rid 0, RF_ACTIVE).  Because the attach fails,
newbus (`device_doattach`, sys/kern/subr_bus.c:2115-2124) unbinds the driver
without invoking any detach method — nothing ever releases the resource.  The
device is left in DS_NOTPRESENT with an active rman IRQ reservation against
it; re-probes of the device continue to work only because rman re-grants the
same owner, but the reservation (and its interrupt vector bookkeeping for MSI
systems) persists.  This is the adv twin of DF-4969 (adw_pci error unwinds).

## Fix validation (runtime A/B)

The IRQ-release hunk of `fix.diff` (identical file as DF-5042's pack; the
diff covers both unwind defects) adds:

```c
if (irqres != NULL)
	bus_release_resource(dev, SYS_RES_IRQ, irqrid, irqres);
```

Patched replay (`run.2.log`): `bus_release_resource: IOPORT=1 IRQ=1`,
"unwind clean (fix effective?)".  Baseline vs patched on the same guest, same
scripted chip, same verbatim driver code.

## Gating precondition

AdvanSys 0x10CD PCI HBA whose attach passes DMA/chip init but fails
`bus_setup_intr` (IRQ exhaustion, msix setup failure), or a VFIO endpoint
engineered to do so.  Availability hygiene only; no escalation path.

## Exploit chain

Not applicable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.