Summary

All synchronization is crit_enter/crit_exit which on DFly is per-CPU only blocks interrupts on issuing CPU. ida_intr registered via bus_setup_intr ida_pci.c:280-281 dispatched on ANY CPU. Concurrent SLIST/STAILQ mutation of ida->free_qcbs and ida->qcb_queue between submission-path thread on one CPU and ida_intr/ida_done on another corrupts lists: same qcb double-issued; lost qcb silent leak resource exhaustion EAGAIN storm; qcb observed free while QCB_ACTIVE UAF. ida_get_qcb L118-131 SLIST_REMOVE_HEAD guarded only by caller crit; ida_done:535-536 SLIST_INSERT_HEAD runs in interrupt context; ida_start:429/432 STAILQ_REMOVE_HEAD races ida_construct_qcb:416 STAILQ_INSERT_TAIL. struct ida_softc idavar.h:126-162 carries NO lock/lwkt_token/spinlock. Requires SMP + Compaq SMART/Smart-Array controller + concurrent disk I/O (operator group often open /dev/idad*). Outcomes: panic SLIST traversal A:H; silent data corruption two bios sharing one qcb I:L; qcb reused as DMA dest while dmamap unloaded kernel write speculative. Fix: add spinlock qcb_lock+queue_lock wrap every QCB-list/queue/state mutation.