Summary

Error-cleanup label bad: releases io resource with rid=0 (dpt_pci.c:175 bus_release_resource(dev,iotype,0,io)) but io was allocated with rid=DPT_PCI_IOADDR (0x10) or rid=DPT_PCI_MEMADDR (0x14). PCI bus resource list stores entry under original rid. resource_list_find(rl,type,0) returns NULL because no SYS_RES_IOPORT/SYS_RES_MEMORY entry has rid=0 (only SYS_RES_IRQ entry has rid=0). resource_list_release (subr_bus.c:2737) panics resource_list_release: cant find resource. Every error path after io allocation (irq alloc failure IDE controller mapping check dpt_alloc/dpt_init/dma_tag_create/bus_setup_intr failure) triggers this panic. Local rid variable overwritten to 0 at line 103 for IRQ allocation losing original io rid. Attacker: physical DPT SmartRAID PCI controller (vendor 0x1044 device 0xa400) malfunctioning during attach kernel auto-probes at boot/hot-plug causing panic instead of graceful device skip; or root kldload dpt on system with failing DPT HW. Impact kernel panic DoS. No code execution/priv-esc/info-leak. Not reachable by unprivileged local users PCI enumeration kernel-internal.