{
  "finding_id": "DF-5158",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Statically proven error-path resource-lifetime bug, not demonstrable on the audit guest. If an ATI SB6xx/7xx/8xx SATA controller is programmed as AHCI (subclass SATA, progif AHCI 1.0) and its AHCI reset times out, ata_ahci_chipinit() releases ctlr->r_res2 without NULLing it (ata-ahci.c:94-97) and returns ENXIO; ata_ati_chipinit() treats ENXIO as fall back to compat IDE and attach anyway (ata-ati.c:113,118-119), so attach succeeds with a stale already-freed resource pointer in the softc, and ata_pci_detach() later double-releases it (ata-pci.c:267-269) -> rman use-after-free/panic. The QEMU guest has only an Intel PIIX3 IDE controller (chip=0x70108086) and no vendor-0x1002 PCI device at all (env.txt), so ata_ati_ident() can never match and no PoC can exercise the path; the trigger additionally requires a hardware fault (reset timeout) plus a privileged detach, hence Low severity and status untested rather than false_positive \u2014 the code flow itself is certain from the cited lines.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (full path:line proof); env.txt (guest pciconf: atapci0 chip=0x70108086 Intel PIIX3, no 0x1002 device => path unreachable on guest); fix.diff (git-apply-able, verified with git apply --check against a clean checkout of sys/) \u2014 decisive lines: ata-ahci.c:94-97 release-without-NULL, ata-ati.c:108-119 ENXIO-means-fallback-then-return-0, ata-pci.c:267-269 detach double-release.",
  "kernel_refs": [
    "sys/dev/disk/nata/chipsets/ata-ati.c:108",
    "sys/dev/disk/nata/chipsets/ata-ati.c:113",
    "sys/dev/disk/nata/chipsets/ata-ati.c:118",
    "sys/dev/disk/nata/chipsets/ata-ahci.c:94",
    "sys/dev/disk/nata/chipsets/ata-ahci.c:96",
    "sys/dev/disk/nata/ata-pci.c:267"
  ],
  "poc_changes": "No PoC exists: the finding is hardware-gated (requires an ATI IXP/SB SATA controller in AHCI mode whose reset times out, then a detach). The audit guest has no vendor-0x1002 PCI device, so the driver never attaches.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 finding on the last nata chipset file. The DF-2094 sibling shape (sata allocate offsets) does not exist here \u2014 this file has no allocate(); the actual sibling is the mirrored error-path lifetime bug: DF-2094 was a no-op release leaking a resource, DF-5158 is a real release leaving a stale pointer that gets double-released. All other hunted classes killed with proof, see the audit result block: setmode tables provably in-bounds via ata_limit_mode canonicalization (ata-all.c:949-964) plus the mode>=ATA_DMA gate (ata-pci.c:864); negative/arbitrary IOCATASMODE modes (ata-all.c:523-526, itself unvalidated and un-priv_check-gated, device-node-permission-gated only) cannot reach the tables.",
  "recommended_fix": "NULL ctlr->r_res2 at ata_ahci_chipinits release-on-error sites and treat only ==0 as AHCI success in ata_ati_chipinit (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff is line-accurate (git apply --check passes against a clean sys/ checkout) and mechanically removes the dangling pointer at both ata-ahci.c error paths plus tightens the ATI success test to ==0, but no baseline could be reproduced on this guest (no ATI hardware), so a patched-kernel boot validation was not possible.",
  "fix_evidence": "fix.diff in this directory; verification of applicability: git apply --check => APPLIES CLEAN against sys/."
}