DF-4075 — mps_request_polled timeout lifecycle: NULL-deref panic + freed-command late completion

File: sys/dev/raid/mps/mps.c:2140-2161 (polled loop), :1720-1727 (NULL print), :592-596 (free on error) Source-level finding; no mps controller on the audit guest (not runnable). See VERDICT.md.

DF-4075 VERDICT — source-level certain, chip-gated (no LSI mps HBA on audit guest)

Shape (i): NULL-deref panic

• mps_update_events():1719 error = mps_request_polled(sc, cm); :1720-1723 set error when reply is NULL / bad status; :1724 then calls mps_print_event(sc, reply) UNCONDITIONALLY.
• On a polled timeout (mps_request_polled:2150-2157: 1000 iterations x 50 ms = 50 s with no reply), cm->cm_reply is NULL (never assigned; also zeroed by every prior mps_free_command — mpsvar.h:520).
• mps_print_event() (mps_table.c) dereferences event->EventDataLength immediately ⇒ NULL deref ⇒ panic. Reachable at attach (mps_attach_log -> mps_register_events -> mps_update_events) and on every event re-registration, whenever the IOC stays silent ~50 s without faulting.

Shape (ii): timed-out command freed while still posted

• mps_request_polled() returns ETIMEDOUT with the request still posted to the controller (no cancellation, no MPS_CM_FLAGS_COMPLETE).
• Callers free immediately: mps_get_portfacts done: (:592-594 frees even on error), mps_update_events (:1727).
• A late reply then hits mps_intr_locked:1581 cm = &sc->commands[desc->AddressReply.SMID] (SMID valid — DF-1369 covers invalid SMIDs): the cm is on the free list or REALLOCATED to a new request ⇒ spurious MPS_CM_FLAGS_COMPLETE / wakeup for the new owner, cm_reply assigned onto a free-list command, and mps_free_command later recycles the stale reply busaddr via mps_free_reply (mpsvar.h:518-519) ⇒ reply-frame double-recycle / command-state corruption.

Distinct from knowns

DF-4014 = mps_user.c ioctl wait path (frees cm + DMA buffer, device DMA writeback). DF-4015 = ioctl command leak. DF-1369 = SMID bounds. This finding is the mps.c core polled path.

Fix

NULL-guard the print; on timeout do not free a still-posted command (complete-with-error or defer reclamation to reinit).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.