DF-4252 — mprsas_fw_work IR-event early return leaks the fw_event and the startup refcount

Where

sys/dev/raid/mpr/mpr_sas_lsi.c:327-331 (MPI2_EVENT_IR_CONFIGURATION_CHANGE_LIST case):

if ((cm = mpr_alloc_command(sc)) == NULL) {
        kprintf("%s: command alloc failed\n", __func__);
        return;                      /* <-- leaks */
}

mprsas_fw_work frees the event only at its tail (:780 mprsas_fw_event_free), and the IR case drops the startup refcount only at :455 (mprsas_startup_decrement). The early return skips both.

What

1. fw_event + fw_event->event_data (kmalloc'd in mprsas_evt_handler :142-156) leak on every occurrence.
2. The startup refcount taken in mprsas_evt_handler (:170-174, whenever wait_for_port_enable is set — every boot-time discovery) is never dropped: startup_refcount can never reach 0 → discovery-completion callbacks (simq release, mprsas_startup_decrement side effects at mpr_sas.c:204-226) never fire for this event → CAM queue stays frozen / boot hangs until the mpr_detach_sas/reinit forced-drain loops (mpr_sas.c:941-942) run.
3. Command-pool exhaustion (which triggers this) is most likely precisely during an IR config-change event storm — the leak then amplifies the exhaustion (each leaked fw_event holds pool pressure).

Trigger

mpr(4) HBA in IR mode, IR_CONFIGURATION_CHANGE_LIST event with Hide/PD-Created reason while the command pool is empty (heavy I/O + event storm). Hardware-gated.

Fix

fix.diff — on alloc failure do what the normal path would have done: decrement the refcount, free the event, then return.

Build/run

build.log — compile-validated on the audit guest.

DF-4252 VERDICT

status: untested (hardware-gated: no mpr HBA on the audit guest) impact class: dos + memory leak confidence: certain (error-path trace)

Trace

• mpr_sas_lsi.c:142-156 — mprsas_evt_handler allocates fw_event + event_data.
• :170-174 — for IR_CONFIG_CHANGE_LIST with wait_for_port_enable, mprsas_startup_increment(sassc) (refcount +1).
• :274-457 — mprsas_fw_work IR case: :327-331 early return when mpr_alloc_command fails, skipping BOTH the :455 mprsas_startup_decrement(sassc) and the :780 mprsas_fw_event_free(sc, fw_event).
• mpr_sas.c:178-226 — refcount 0 is what unfreezes the simq and completes startup; a stranded +1 keeps MPRSAS_IN_STARTUP handling pending until a forced drain (reinit at mpr_sas.c:941-942 or detach).

Consequences: (a) kernel memory leak per failed event, (b) discovery/ startup completion can hang, (c) leak rate correlates with command-pool pressure (the same condition that triggers it), compounding pool exhaustion — mps(4) twin of the DF-4015 family pattern.

Fix (fix.diff): decrement + free before the early return. Compile-validated on the guest (build.log). fix_status: not_testable (runtime needs HBA + pool exhaustion during an IR event).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.