# DF-5048 — bios submitted to a wedged IDA controller park forever: unkillable D-state issuers, unbounded bio_queue (DF-5026 pattern)

File: `sys/dev/raid/ida/ida_disk.c` (pass 2, GLM 5.3)
Bucket: base:dev | Severity: Low | Pattern: DF-5026 (ips parked bios)

## What the bug is

`idad_strategy()` (sys/dev/raid/ida/ida_disk.c:144-189) validates
softc/write-protect/zero-length locally and then hands the bio to the
controller with no failure path of its own:

```c
	bio->bio_driver_info = drv;
	crit_enter();
	devstat_start_transaction(&drv->stats);
	ida_submit_buf(drv->controller, bio);      /* ida_disk.c:175 */
	crit_exit();
```

`ida_submit_buf()` (sys/dev/raid/ida/ida.c:364-370) sorts the bio onto
`ida->bio_queue` and calls `ida_construct_qcb` + `ida_start`. There is no
route to `biodone()` except a controller completion:

- `ida_construct_qcb` silently returns when QCBs are exhausted
  (ida.c:385-387) — the bio stays parked in `bio_queue`;
- `ida_start` stops when the FIFO is full (ida.c:429-431);
- `ida_done` is the only reaper (ida.c:498-537), and it runs only from
  `ida_intr` (completions) or `ida_wait` (internal commands);
- the driver has **no watchdog, no timeout, no offline/fail state, and no
  detach-time flush** — nothing in the driver ever fails a parked bio.

If the controller wedges (stops delivering completions — hardware fault,
PCIe error not surfaced, box being torn down), every bio parks forever.
Each issuer sleeps in `biowait` in an **unkillable D-state**, all mounted
filesystems on idad volumes hang, and `bio_queue` grows without bound while
the VM page daemon stalls on dirty buffers — a system-wide livelock that
only a reboot clears. Exactly the DF-5026 ips pattern, with the aggravation
that IDA has not even an offline flag to gate on.

## Threat model / trigger

Requires an IDA controller that stops completing I/O (genuine hardware
wedge). No unprivileged or software-only trigger — hence Low (DF-5026 was
Medium because an IPS adapter can be switched offline by configuration
commands without hardware failure; IDA has no such knob).

## PoC / verification status

Hardware-gated: no Compaq SMART/IDA device on the audit guest (env.txt:
pciconf shows no 0x0e11 function; no /dev/idad*). The code trace above is
line-accurate — there is literally no `biodone` reachable for a parked bio
outside ida_intr/ida_done.

## Fix

1-second callout watchdog: if work has been pending continuously for 60
seconds, fail everything queued with ETIMEDOUT and keep failing new arrivals
(fix.diff, ida.c + idavar.h).

## Reproduce (on hardware)

```
# IDA box with a mounted idad filesystem; wedge the controller (e.g. trigger
# a PCI error / stall the card in a test jig):
cat /dev/idad0 > /dev/null    # parks in D-state forever; ps shows 'D*' state
                              # bio_queue grows; box needs hard reset
```