# DF-5158 — build/run

No PoC program exists for this finding: the vulnerable path requires an ATI
(0x1002) IXP/SB6xx-8xx SATA controller in AHCI progif whose AHCI reset times
out, plus a driver detach — none of which the QEMU audit guest can provide
(guest has Intel PIIX3 IDE only; see env.txt). The defect is a statically
proven error-path resource-lifetime bug, not a user-triggerable memory-safety
primitive.

- Expected (on matching hardware): attach succeeds after "AHCI controller
  reset failure" console message; later `kldunload`/unplug → panic in
  rman_release_resource (double release).
- Artifacts: VERDICT.md (full narrative + path:line proof), fix.diff
  (git-apply-able), env.txt (guest PCI/uname evidence), verdict.json.