DF-1429 - Verification Verdict

Status: reproduced (reproduced=1) Impact: none Confidence: likely

Finding

NULL-deref panic in twe_report_request: device_printf(td_disk) when td_disk is NULL

Source Location

sys/dev/raid/twe/twe.c:1862-1888

Verdict

Source-confirmed: NULL-deref panic in twe_report_request: device_printf(td_disk) when td. Fix applies and compiles.

Fix Status

fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

Summary

twe_report_request at twe.c:1862/1866/1870/1880/1888: device_printf(sc->twe_drive[unit].td_disk,...). td_disk NULL for unattached units. device_printf(NULL) -> device_get_name(NULL) -> NULL->devclass -> panic. Trigger: TWEIO_COMMAND with opcode targeting unattached unit returns fatal/warning status. Root only (/dev/twe 0600). Fix: NULL-guard td_disk, fall back to twe_printf.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.