# DF-5115 evidence pack

**Finding:** `ips_pci_detach()` clears `sc->configured` before the cleanup that
can still fail with EBUSY — after one failed detach the driver's state machine
is permanently corrupted: shutdown stops flushing the adapter cache, and any
retried detach *silently succeeds* without tearing down the interrupt, so the
softc is later freed with `sc->ips_adapter_intr(sc)` still registered
(interrupt-context UAF).

**Status: untested** — reproduction requires a physical IBM ServeRAID
controller; the audit QEMU guest provably has none (see `env.txt`,
`trigger.sh` exits 42 there).

## Contents

- `VERDICT.md` — full code trace and consequence analysis
- `trigger.sh` — hardware-gated trigger script (exit 42 without ServeRAID)
- `env.txt` — live guest evidence: uname, pciconf (no 1014:01bd/002e,
  9005:0250), kernel config, kldload probe result
- `fix.diff` — minimal fix: move `sc->configured = 0` after the EBUSY check

## Reproduce (on real hardware only)

```sh
sh trigger.sh          # expects: 1st kldunload EBUSY, 2nd returns 0 (bug)
```

Success criterion: second `kldunload ips` returns 0 while the adapter IRQ is
still installed; the next interrupt (or unit destruction + interrupt) hits
`ips_morpheus_intr`/`ips_copperhead_intr` on freed memory → panic with ips
backtrace.