{
  "finding_id": "DF-5153",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Line-proven incomplete error-path unwind in dpt_pci_attach(): on bus_setup_intr failure (dpt_pci.c:163-169) the code jumps to bad: releasing only io/irq, while dpt_attach() (called at :159) has already XPT-registered up to 3 SIMs + wildcard CAM paths (dpt_scsi.c:1466-1482), registered the shutdown_post_sync handler with a discarded tag (dpt_scsi.c:1487-1488), and dpt_alloc() TAILQ-linked the softc on the global dpt_softcs (dpt_scsi.c:1165). None of that is undone: the phantom SIM stays resolvable by CAM and pokes bus_space through a handle whose rman record was released (irq, correct rid 0) or leaked (io, the DF-2151 wrong-rid no-op), dptshutdown keeps firing at every reboot against the released window, DMA CCB memory/sg maps/3 child tags leak permanently, and no interrupt handler exists so every command routed to the phantom bus hangs forever. Untested because the entry path is hardware-gated: guest pciconf shows no 0x1044:0xa400 DPT device (env.txt) and no unprivileged trigger exists; ceiling on real hardware is cross-device PIO/MMIO corruption at boot plus boot-time DoS. No kernel-heap primitive, so no uid=0 route - the class does not permit one.",
  "exploit_chain": "",
  "evidence": "README.md (bug + consequence table), VERDICT.md sections 1-2 with the stays-alive table, fix.diff (git-apply-clean reverse-order teardown), env.txt (guest has no DPT PCI device). Decisive lines: sys/dev/raid/dpt/dpt_pci.c:163-169 vs :159 and bad: at :173-179; dpt_scsi.c:1466-1488.",
  "kernel_refs": [
    "sys/dev/raid/dpt/dpt_pci.c:159",
    "sys/dev/raid/dpt/dpt_pci.c:163",
    "sys/dev/raid/dpt/dpt_pci.c:173",
    "sys/dev/raid/dpt/dpt_scsi.c:1165",
    "sys/dev/raid/dpt/dpt_scsi.c:1466",
    "sys/dev/raid/dpt/dpt_scsi.c:1487",
    "sys/dev/raid/dpt/dpt_scsi.c:1718",
    "sys/kern/subr_bus.c:3328"
  ],
  "poc_changes": "no seed PoC existed; none authored - path is unreachable without DPT hardware (KLD harness would only restate the code text; no allocator-detectable primitive unlike DF-5141)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "hw-gated (DPT SmartRAID 0x1044:0xa400 + bus_setup_intr failure at attach). Distinct from known DF-2151 (wrong-rid io release): this is the CAM/XPT/shutdown-handler/softc/DMA unwind gap on the same goto. Family shape: DF-5115 (ips, untested), DF-5141 (mlx, reproduced - but that had a genuine double-kfree). Negative: irq release rid 0 IS correct (allocated rid 0 at :103-105). dpt_attach() return value ignored at :159 is inert (no dangling refs) - not filed.",
  "recommended_fix": "On bus_setup_intr failure, tear down in reverse order before bad: xpt_free_path each paths[ch], xpt_bus_deregister+cam_sim_free each sims[ch], EVENTHANDLER_DEREGISTER(shutdown_post_sync, tag stored in softc), crit_enter/dpt_free/crit_exit, bus_dma_tag_destroy(parent_dmat); release io with the rid it was allocated at (io_rid).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff authored post-verification against the read-only sys/ tree; git apply --check clean (dpt.h + dpt_scsi.c tag plumbing + dpt_pci.c teardown). Baseline cannot be reproduced on the guest (no DPT HBA), so patched-kernel validation is not_testable.",
  "fix_evidence": "findings/poc/DF-5153/fix.diff (3-file unified diff, apply-checked); VERDICT.md section 5."
}