DF-3876 — mfi_aen_setup dereferences log_state before checking the error that leaves it NULL

mfi.c:1019-1026:

if (seq_start == 0) {
    error = mfi_get_log_state(sc, &log_state);
    sc->mfi_boot_seq_num = log_state->boot_seq_num;   /* deref FIRST */
    if (error) {
        if (log_state)
            kfree(log_state, M_MFIBUF);
        return (error);

mfi_get_log_state (mfi.c:977-1005) returns EBUSY (no free command) or ENOMEM without ever setting *log_state, leaving it NULL (mfi.c:1010); the immediate unconditional deref reads NULL -> kernel panic. Additionally the attach-time caller at mfi.c:703 is if ((error = mfi_aen_setup(sc, 0), 0) != 0) — the comma operator discards the real error, so the botched check at 704-706 is dead code anyway.

Hardware/timing-gated (needs the free-command pool exhausted or kmalloc failure exactly during boot/AEN re-registration); Low.

DF-3876 VERDICT — inconclusive (hardware-gated); defect certain in source

• Order-of-operations verified: mfi.c:1020 assigns from log_state->boot_seq_num before the if (error) at 1022; *log_state stays NULL on the EBUSY/ENOMEM paths of mfi_get_log_state (mfi.c:984-987 dequeue failure returns before the mfi_dcmd_command allocation).
• The comma-operator bug at mfi.c:703 (, 0) swallows the error) documented.
• Trigger needs command-pool exhaustion / allocation failure at exactly the wrong boot instant — real but improbable; Low.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.