# DF-5167 — bt: bus_setup_intr() failure in bt_attach leaves XPT-registered SIM and
wildcard path live against a softc whose resources bt_pci_attach() then releases

File: `sys/dev/disk/buslogic/bt_pci.c` (with root cause in `sys/dev/disk/buslogic/bt.c`)
Pass 2 (GLM 5.3). Severity: Low. Confidence: certain (static code-path proof).

## What breaks

`bt_attach()` (bt.c:737) registers a CAM SIM and wildcard path **before** it sets up
the interrupt:

- bt.c:770  `xpt_bus_register(bt->sim, 0)` — succeeds
- bt.c:776  `xpt_create_path(&bt->path, ... CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD)` — succeeds
- bt.c:789  `bus_setup_intr(dev, bt->irq, INTR_MPSAFE, bt_intr, bt, &bt->ih, NULL)`
             — on failure prints and returns the error at bt.c:792-794 **without**
             `xpt_bus_deregister()`, `xpt_free_path()` or `cam_sim_free()`.

The PCI glue then treats any `bt_attach()` failure as "nothing was published" and
releases everything (bt_pci.c:152-156):

- bt_pci.c:93-96   `bus_release_resource(dev, SYS_RES_IOPORT, BT_PCI_IOADDR, bt->port)`
- bt_pci.c:97-98   `bus_release_resource(dev, SYS_RES_IRQ, 0, bt->irq)`
- bt_pci.c:99 → bt.c:179-236 `bt_free_softc()`: unloads/frees the mailbox block,
  the CCB array and every S/G map, destroys all child DMA tags, and
  `lockuninit(&bt->lock)` (bt.c:236).

Result: the XPT still owns a registered `bt` bus whose `btaction`/`btpoll`
closures capture the softc. The CAM probe periph reacts to the bus registration
and issues a bus scan; `btaction()` then:

1. runs under `bt->lock` — a lock that has just been `lockuninit()`'d;
2. touches `bt_inb(bt, STATUS_REG)` through an rman port record that was already
   released (and can be re-allocated to a different device on the same ports);
3. pulls BCCBs from `bt->free_bt_ccbs`, which points into `bus_dmamem_free()`'d
   memory — a use-after-free read/write path once the pages are reused.

This is the BusLogic sibling of dpt_pci DF-5153 (same family, same pass) and is
distinct from the known bt_pci.c pair DF-2162/DF-2431 (which cover only the
`parent_dmat` tag leak; this finding is about CAM state + released rman/DMA
memory, a different resource set and failure point).

## Trigger / threat

Boot-time only: a real BusLogic MultiMaster PCI HBA must be present and
`bus_setup_intr()` must fail (interrupt table exhaustion, conflicting MP/ACPI
table entries, ...). Not reachable from an unprivileged user; not controllable
by a hostile card (the failure is host-side). Impact ceiling: panic / kernel
memory corruption during/after boot on that machine. Hence Low.

## Verification status

**Skipped per contract** (Low severity, hardware-preconditioned trigger — the
QEMU guest has no BusLogic PCI HBA, so neither the boot-time failure nor the
card itself can be instantiated). `verdict.json` carries the persistable status
`untested` for that reason; the finding is proven by code-path analysis with
exact citations (see VERDICT.md).

## Fix

`fix.diff` — deregister/free the CAM state in `bus_setup_intr()`'s error branch
in `bt.c` before returning, mirroring the existing `xpt_create_path` failure
branch (bt.c:776-783).