# DF-5048 VERDICT — parked bios / no completion path on a wedged IDA controller

**status: untested (hardware-gated) | impact: none demonstrated (local DoS class) | confidence: likely**

## Reproduced?

No. Requires a physical Compaq SMART/IDA controller that stops completing
I/O. Guest evidence (env.txt): no 0x0e11 PCI function, driver never attaches,
`/dev/idad*` does not exist. Untested = hardware absent.

## Why the finding is real (trace)

Completion-flow enumeration — there is no other `biodone` for bios that
enter `ida_submit_buf`:

1. `idad_strategy` local error paths all biodone (ida_disk.c:153-156, 161-164,
   169, 179-188) — those are fine (this is what DF-5012 fixed for mfi; ida
   already has it).
2. The submit path (ida_disk.c:172-177) -> `ida_submit_buf` (ida.c:364-370):
   `bioqdisksort(&ida->bio_queue, bio)` + `ida_construct_qcb` + `ida_start`.
3. `ida_construct_qcb` (ida.c:372-417): pops a bio only when a free QCB
   exists; out of QCBs -> return, bio parked (:385-387). Popped bios become
   qcbs queued for `ida_start` (:416).
4. `ida_start` (ida.c:424-440): submits while FIFO not full; else breaks.
5. The ONLY biodone for these bios is `idad_intr` (ida_disk.c:213-226) called
   from `ida_done` (ida.c:530-533), reached only from `ida_intr`
   (ida.c:470-493, hardware completions) — or `ida_wait` for internal
   commands (never for disk bios).
6. No callout/watchdog/timeout exists anywhere in ida.c or ida_disk.c
   (verified by grep: no `callout`, no `timeout`, no offline flag in
   idavar.h:122-124 — flags are ATTACHED/FIRMWARE/INTERRUPTS only).

Therefore: controller delivers no completion => QCBs never return to
`free_qcbs` => QCB pool exhausts after IDA_QCB_MAX=256 requests => all
further bios park in `bio_queue` forever => `biowait` sleeps are
unkillable D-states; dirty-buffer pressure stalls the VM; queue is
unbounded. System-wide hang until reboot. Family precedent: DF-5026
(ips, Medium — reachable via adapter-offline config; here only via a real
hardware wedge, hence Low).

Not a duplicate of DF-1915/DF-4837 (ida.c): those cover detach-time freeing
and DMA-direction corruption; this covers the hang/livelock from absent
completion paths.

## Fix assessment

fix.diff adds a 1 Hz callout watchdog (ida.c + idavar.h): 60 consecutive
ticks with pending work and no drain => fail all queued bios with
ETIMEDOUT+B_ERROR and keep failing new arrivals, so issuers become killable
and the queue cannot grow unbounded. 60s is far beyond any real SMART-array
latency; false-positive risk under extreme (but live) load is the accepted
tradeoff, same remedy family as DF-5026's fix. fix_status=not_testable: no
IDA hardware on the guest to build/validate a patched kernel.

## Bottom line

Real absence-of-failure-path defect, code-certain, hardware-gated. Low.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.