{
  "finding_id": "DF-5058",
  "status": "untested",
  "verdict": "Genuine DF-5048/DF-5026-family parked-bio hang, mlx instance: mlxd_strategy (mlx_disk.c:156-190) -> mlx_submit_bio (mlx.c:683-693) queues every bio on sc->mlx_bioq; mlx_startio (mlx.c:1713-1805) dequeues only while a command slot is free \u2014 mlx_getslot EBUSY (mlx.c:1739-1742, limit-4 reached) parks the bio. The ONLY restart is mlx_done -> mlx_startio (mlx.c:2160-2161) from the hardware interrupt or the 1 Hz mlx_periodic (mlx.c:1040), both of which depend on the controller delivering completions. No timeout exists anywhere: mc_timeout is set in mlx_start (mlx.c:2085-2086) under XXX not currently used and never read; mlx_complete (mlx.c:2173-2223) only processes status != BUSY; nothing ever fails a stale command or a queued bio. Therefore a controller that accepts commands and then stops completing (firmware hang after accept, surprise fault while BUSY) pins every command slot BUSY forever, after which every further bio parks on mlx_bioq indefinitely: biowait sleepers are unkillable D-states (system-wide hang if root/swap live on mlxd) and the bioq grows unbounded -> kernel memory exhaustion. The fast-fail wedge path IS handled (mlx_start failure -> mlx_completeio -> biodone(EIO), mlx.c:1796-1800); the parked path is not. Untested solely because the guest has no Mylex DAC960 PCI function (env.txt) although the driver is compiled into the running kernel. Severity Low matching DF-5048 (trigger requires a real controller fault, unlike ips DF-5026 whose offline config state parked bios deterministically).",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "saturate /dev/mlxdN with I/O + controller fault that stops completions after accept -> all me_max_commands slots stuck BUSY -> mlx_getslot EBUSY for every subsequent bio -> bios park on mlx_bioq forever -> unkillable D-state issuers + unbounded queue growth (kernel memory exhaustion). DoS only, hardware-fault-triggered; no privilege-escalation primitive.",
  "evidence": "env.txt (live guest: no Mylex PCI function, no /dev/mlx*, driver in kernel); VERDICT.md completion-flow enumeration with path:line for every hop (no other biodone exists for parked bios); fix.diff (git apply --check: APPLIES_CLEAN)",
  "kernel_refs": [
    "sys/dev/raid/mlx/mlx_disk.c:156-190",
    "sys/dev/raid/mlx/mlx.c:683-693",
    "sys/dev/raid/mlx/mlx.c:1713-1805",
    "sys/dev/raid/mlx/mlx.c:2072-2112",
    "sys/dev/raid/mlx/mlx.c:2122-2167",
    "sys/dev/raid/mlx/mlx.c:2173-2223",
    "sys/dev/raid/mlx/mlx.c:977-1044"
  ],
  "poc_changes": "No runnable PoC exists (hardware-gated). Pack contains hardware-absence evidence and the completion-flow trace; fix.diff generated via edited copies + diff -u and validated with git apply --check.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "n/a \u2014 hardware-gated, no PoC build possible",
  "run_cmd": "vm.sh run_root pciconf -l | grep -iE \"1069|1011\"; ls /dev/mlxd* /dev/mlx* (result: absent \u2014 driver cannot attach)",
  "code_hash": "5057b8361f7bdd676a0bf648b1b34b6cbbc7383092b138d03380f0b174b1b0ab",
  "notes": "Family: DF-5026 (ips, Medium \u2014 deterministic via adapter-offline config), DF-5048 (ida, Low \u2014 hardware fault only); mlx matches the ida tier. Not a duplicate of DF-3951 (mlx_start wedge-path slot leak \u2014 the fast-fail path), DF-3950 (mlx_wait_command sleep loop \u2014 internal sync commands), DF-2074, DF-5057. Guest left clean.",
  "recommended_fix": "Stall watchdog in the existing 1 Hz mlx_periodic callout: when parked bufs exist and mlx_done completed nothing for 60 consecutive seconds, fail every queued bio with ETIMEDOUT and fail new arrivals in mlx_submit_bio until completions resume.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds mlx_stall_ticks to struct mlx_softc (mlxvar.h), resets it whenever mlx_done completes anything (healthy load always produces completions, so no false positive under sustained I/O), and after 60 no-progress seconds with parked bufs drains mlx_bioq failing every bio with ETIMEDOUT+B_ERROR while mlx_submit_bio fails new arrivals \u2014 issuers become killable and the queue cannot grow unbounded. Commands stuck in hardware keep their slots (fail-stop until reset), the conservative choice. Cannot be build/boot validated: no Mylex hardware on the guest. Diff is git-apply-clean against sys/.",
  "fix_evidence": "fix.diff (git apply --check: APPLIES_CLEAN); hunks at mlx.c mlx_periodic (watchdog) + mlx_submit_bio (wedged fast-fail) and mlxvar.h (mlx_stall_ticks)"
}