DF-3803 evidence pack

CCB+path leak per TM reuse/escalation in mprsas_prepare_for_tm. Read VERDICT.md. verdict.json: not_reproduced (no SAS3 hardware on guest).

DF-3803 — mprsas_prepare_for_tm leaks a CCB + path on every TM reuse/escalation

• File: sys/dev/raid/mpr/mpr_sas.c
• Class: unbounded kernel memory leak under error recovery
• Severity: Low / Confidence: certain (statically provable)
• Status on guest: not_reproduced — no SAS3 HBA (see env.txt)

Defect

mprsas_prepare_for_tm (mpr_sas.c:3787-3813) allocates a fresh CCB and path and assigns them unconditionally:

    ccb = xpt_alloc_ccb();                        /* :3801 */
    if (ccb) {
        if (xpt_create_path(&ccb->ccb_h.path, ...) != CAM_REQ_CMP)
            xpt_free_ccb(&ccb->ccb_h);
        else {
            tm->cm_ccb = ccb;                 /* :3808 — overwrites, no free */
            ...
        }
    }

mprsas_free_tm (mpr_sas.c:243-270) frees only the last tm->cm_ccb.

The error-recovery state machine calls prepare_for_tm multiple times on the same tm:

1. mprsas_send_abort → prepare (mpr_sas.c:1643)
2. abort completes, more timed-out commands → mprsas_send_abort again (mpr_sas.c:1584 → prepare at 1643) — leaks ccb #1
3. abort fails → LUN reset (mpr_sas.c:1594 → mpr_sas.c:1476) — leaks again
4. LUN reset fails → target reset (mpr_sas.c:1365 → mpr_sas.c:1487) — leaks again

Each leak is sizeof(union ccb) (several hundred bytes, includes a kmalloc'd timeout_ch, cam_xpt.c:4933-4935) plus a cam_path. A target with N timed-out commands under a failing device leaks N-1 CCBs; sustained error storms leak without bound. Memory pressure on a storage box is a availability problem, not a corruption problem → Low.

Fix

Free the previous tm->cm_ccb (path + ccb) before overwriting — see fix.diff.

Guest verification

No SAS3 controller in the guest → the SIM never runs; static proof only. See env.txt.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.