DF-3802 evidence pack

TM early-return -1 paths wedge the target (targ->tm stuck, timedout ccbs never completed) and leak the TM. Read VERDICT.md. verdict.json: not_reproduced (no SAS3 hardware on guest).

DF-3802 — TM error-path early returns wedge the target forever and leak the TM

• File: sys/dev/raid/mpr/mpr_sas.c
• Class: unkillable I/O hang (ccb never completed) + high-priority command leak
• Severity: Medium / Confidence: likely
• Status on guest: not_reproduced — no SAS3 HBA (see env.txt)

Defect

mprsas_send_abort and mprsas_send_reset have early -1 return paths that neither free the task-management command nor clear targ->tm:

• mpr_sas.c:1609-1615 — send_abort: targ = cm->cm_targ; if (targ->handle == 0) return -1;
• mpr_sas.c:1456-1461 — send_reset: if (target->handle == 0) ... return -1;
• mpr_sas.c:1489-1492 — send_reset: unknown type → return -1

Every caller ignores the return value:

• mpr_sas.c:1731 (mprsas_scsiio_timeout: targ->tm = mprsas_alloc_tm(sc); ... mprsas_send_abort(sc, targ->tm, cm);)
• mpr_sas.c:1351, mpr_sas.c:1584 (mprsas_send_abort re-arm from logical_unit_reset_complete / abort_complete)
• mpr_sas.c:1365, mpr_sas.c:1594 (mprsas_send_reset escalation)

After the early return:

1. targ->tm remains set forever (only the TM completion handlers clear it — mpr_sas.c:1307/1353/1403/1431/1553/1578 — and the TM was never sent, so it never completes; mprsas_free_tm is never called).
2. The timed-out command stays on targ->timedout_commands in state MPR_CM_STATE_TIMEDOUT with its ccb never completed — once a ccb is in the SIM, CAM has no further timeout for it; the issuing thread hangs forever.
3. Every subsequent timeout on the target takes the targ->tm != NULL path (mpr_sas.c:1716-1722) and piles more never-aborted commands.
4. The allocated high-priority command leaks (pool shrink under repetition).

Reachable trigger (provable sequence)

Outstanding I/O to a RAID volume that is deleted:

• mprsas_prepare_volume_remove sends the reset TM (mpr_sas.c:439-490), but mprsas_remove_volume clears targ->handle = 0 on success (mpr_sas.c:411-429) without draining targ->commands — unlike mprsas_remove_device, which completes them (mpr_sas.c:621-628).
• Any command still on targ->commands that times out afterwards runs mprsas_scsiio_timeout → allocates targ->tm → mprsas_send_abort sees targ->handle == 0 → returns -1 → wedge + leak, per above.

The same wedge occurs mid-error-recovery when the handle is cleared while a recovery TM exists (abort escalation at mpr_sas.c:1584/1594).

Fix

Handle the -1 returns: free the TM, clear targ->tm, and complete the timed-out ccbs with CAM_DEV_NOT_THERE; also drain targ->commands in mprsas_remove_volume like mprsas_remove_device does. See fix.diff.

Guest verification

No SAS3 controller in the guest; no mpr SIM registered → the sequence cannot run. Static proof stands. See env.txt.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.