# DF-5082 — os_map_pci_bar() unchecked bus_alloc_resource_any() → rman_get_virtual(NULL) NULL-deref panic at attach

`sys/dev/raid/hptrr/hptrr_os_bsd.c:101-104` — DF-5039 twin (hpt27xx).

## Reproduce

1. Guest up with kernel source: `dfbsd-qemu/vm.sh up`
2. Push + build:
   `scp -F dfbsd-qemu/config df5082_harness.c build.sh dfbsd:/root/`
   `dfbsd-qemu/vm.sh run_root 'sh /root/build.sh'`
3. Load module, run the FIXED variant first, then the VERBATIM copy:
   `dfbsd-qemu/vm.sh run_root 'kldload /root/df5082/df5082.ko; sysctl df5082.trigger=2; sysctl df5082.trigger=1'`

## Expected

- `trigger=2`: console/dmesg prints `DF5082-fixed: ... guarded, no
  panic`; guest survives.
- `trigger=1`: console shows `Fatal trap 12: page fault while in kernel
  mode`, `fault virtual address = 0x40`, `Stopped at ... movq
  0x40(%rax),%rsi`; the ssh call times out (RC=124), guest wedged at
  `db>`.

0x40 is `offsetof(struct resource, r_virtual)` (sys/sys/rman.h:106) —
the fault address proves the read is the inlined `rman_get_virtual(NULL)`
from hptrr_os_bsd.c:104.

Full story: VERDICT.md. Fix: fix.diff (validated A/B in-harness).