DF-4078 — mps unbounded waits and ignored reinit errors can wedge the adapter permanently

Files/lines: mps.c:2129 + :2221 (infinite lksleep), :353 (ignored mps_reregister_events error), :1769-1772 (EINPROGRESS treated as failure); mps_sas.c:1091 (frozen simq) Source-level finding; chip-gated DoS. See VERDICT.md.

DF-4078 VERDICT — source-level likely, chip-gated (permanent I/O hang / thread hang)

(1) Indefinite sleep with timeout == 0

mps_wait_command():2129 lksleep(cm, &sc->mps_lock, 0, "mpswait", timeout*hz) — with timeout 0 DragonFly sleeps forever. mps_read_config_page():2221 passes 0. A silent-but-not-faulted IOC (the periodic watchdog calls mps_reinit only on MPI2_IOC_STATE_FAULT, mps.c:1247-1252) hangs the config-path thread indefinitely (attach / CAM contexts).

(2) mps_reinit ignores mps_reregister_events() failure

mps_reinit():353 calls mps_reregister_events(sc) and discards the return. On failure (mps_alloc_command EBUSY from an exhausted pool, or bus_dmamap_load error) the completion that would call mpssas_startup() (mps_reregister_events_complete:1654) never fires; the simq frozen in mpssas_handle_reinit (mps_sas.c:1091 xpt_freeze_simq) is never released ⇒ every I/O on the adapter wedges until reboot.

(3) EINPROGRESS mishandled

mps_reregister_events():1769-1772 treats mps_map_command() EINPROGRESS as a failure return, though the async DMA-map callback will still enqueue and complete the request — a spurious entry into exactly the failure path of (2).

DoS only; no memory corruption. Confidence 'likely' (needs a misbehaving/exhausted IOC+pool state).

Fix

Finite timeout at :2221; check and retry/fail loudly on :353; accept EINPROGRESS at :1769.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.