{
  "finding_id": "DF-5057",
  "title": "mlxd lifetime TOCTOU: MLX_DETACH_DRIVE checks MLXD_OPEN then sleeps in mlx_flush before device_delete_child; mlxd_detach has no recheck and no in-flight drain — softc freed under racing open fds / in-flight bios (DF-5025/DF-5046 family, last LD sibling)",
  "verdict": "untested",
  "impact": "none",
  "confidence": "certain",
  "reproduce": {
    "build": "n/a — hardware-gated (no Mylex DAC960 PCI function on the guest)",
    "run": "vm.sh run_root 'pciconf -l | grep -i 1069; ls /dev/mlxd*' -> both empty (driver compiled into X86_64_GENERIC:134 but never attaches)",
    "expected": "On hardware: root ioctl(MLX_DETACH_DRIVE) + concurrent open of /dev/mlxdN inside the mlx_flush window -> open fd outlives device_delete_child; mlxd_close/strategy/ioctl and late mlxd_intr (devstat_end_transaction_buf, mlx_disk.c:204) write into the freed mlxd_softc"
  },
  "kernel_refs": [
    "sys/dev/raid/mlx/mlx_disk.c:86-115",
    "sys/dev/raid/mlx/mlx_disk.c:290-301",
    "sys/dev/raid/mlx/mlx_disk.c:192-206",
    "sys/dev/raid/mlx/mlx.c:774-804",
    "sys/dev/raid/mlx/mlx.c:1516-1549",
    "sys/dev/raid/mlx/mlx.c:1677-1703",
    "sys/dev/raid/mlx/mlx.c:589-622",
    "sys/dev/raid/mlx/mlx.c:545-576",
    "sys/dev/raid/mlx/mlx_pci.c:54",
    "sys/dev/raid/mlx/mlx.c:466-468",
    "sys/kern/subr_disk.c:873-897"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}