# DF-5047 — idad_dump reports fake success for controller-rejected/failed dump writes (DF-5027 pattern in IDA)

File: `sys/dev/raid/ida/ida_disk.c` (pass 2, GLM 5.3)
Bucket: base:dev | Severity: Low | Pattern: DF-5027 (ips_disk fake-success dumps)

## What the bug is

`idad_dump()` (sys/dev/raid/ida/ida_disk.c:191-211) hands each dump chunk to
`ida_command()` and returns its error straight to the crash-dump machinery:

```c
	if (ap->a_length > 0) {
		error = ida_command(drv->controller, CMD_WRITE, ap->a_virtual,
		    ap->a_length, drv->drive, ap->a_offset / DEV_BSIZE, DMA_DATA_OUT);
	}
```

But `ida_command()` (sys/dev/raid/ida/ida.c:317-362) can only ever return
EAGAIN (no QCB, ida.c:329-332) or ETIMEDOUT (5s wait expiry, ida.c:449-461).
The controller's own status for the command is detected and then **discarded**:

- `ida_done()` reads `qcb->hwqcb->req.error` and flags HARD_ERROR /
  CMD_REJECTED (ida.c:515-524), but for `IDA_COMMAND` requests it merely does
  `wakeup(qcb)` (ida.c:526-528) — the error goes nowhere.
- `ida_wait()` returns 0 unconditionally once the qcb completes
  (ida.c:463-467 polling path; :449-453 interrupt path).
- The author knew: `/* XXX should have status returned here? */`
  (ida.c:358-359).

Net effect: a dump write that the controller rejected or hard-errored returns
success to `dumpsys`, which keeps advancing `dumplo` and finally prints
"Dump complete" (sys/platform/pc64/x86_64/dump_machdep.c:353-364). The saved
crash dump silently lacks or mis-contains the affected pages — exactly the
DF-5027 copperhead pattern, here on Compaq SMART/IDA.

## Threat model / trigger

Requires (a) an IDA controller as dump device, (b) a kernel panic, and
(c) a controller that fails/rejects the write (failing cache, cable pulled,
array gone). Result: silently corrupt/empty core dump during incident
response — an integrity failure of the forensic record, not memory unsafety.

## PoC / verification status

Hardware-gated (no Compaq SMART/IDA PCI device on the audit guest —
pciconf evidence in env.txt; the driver never attaches, no /dev/idad* dump
device can be configured). Code trace is line-accurate; see VERDICT.md.

## Fix

Record the controller status per-qcb in `ida_done()` and propagate it out of
`ida_command()`. See fix.diff (ida.c + idavar.h).

## Reproduce (on hardware)

```
# IDA box: configure dumpdev=/dev/idad0s0?, panic the box while the
# controller's write path is failing (pull battery/cache, fail the array):
#   sysctl debug.debugger=1 ... call panic from ddb
# expect: dumpsys prints "ok"/"Dump complete" even though writes failed;
# savecore later yields a corrupt/short dump.
```