DF-4254 — targ->flags |= ~MPR_TARGET_FLAGS_RAID_COMPONENT sets every flag bit instead of clearing one

Where

sys/dev/raid/mpr/mpr_sas_lsi.c:597-599 (MPI2_EVENT_IR_PHYSICAL_DISK, PD-state OFFLINE / NOT_CONFIGURED / NOT_COMPATIBLE / default branch):

if (targ) {
        targ->flags |= ~MPR_TARGET_FLAGS_RAID_COMPONENT;   /* BUG */

Should be &= ~ (clear the RAID_COMPONENT bit). This is the mpr twin of mps(4) DF-1698 (mps_sas_lsi.c), which was filed for the mps driver — the same defect exists here and was not covered by any mpr finding.

What

|= with the inverted mask (0xFFFFFFFE on a flags field holding MPR_TARGET_FLAGS_RAID_COMPONENT | MPR_TARGET_IS_SATA_SSD bits): * the RAID_COMPONENT bit itself stays SET — the disk that just went OFFLINE/removed from the volume remains marked as a hidden RAID component, so mprsas_add_device (:909) keeps skipping the ID/reuse checks for it and the OS never sees the disk (locked out), * every other flag bit is force-set, including MPR_TARGET_IS_SATA_SSD, which mprsas_ir_shutdown (:1677-1698) uses to decide stop_at_shutdown — an affected HDD gets treated as SSD and is NOT stopped on shutdown → spindle still spinning at power-off (the exact data-corruption scenario the SSU path exists to prevent).

Trigger

mpr(4) IR-mode HBA; a phys disk state-change event with ReasonCode STATE_CHANGED and NewValue OFFLINE/NOT_CONFIGURED/NOT_COMPATIBLE while a target exists for the handle. Firmware-event-driven; hardware-gated on the audit guest.

Fix

fix.diff — one character-class change:

-                       targ->flags |=
-                       ~MPR_TARGET_FLAGS_RAID_COMPONENT;
+                       targ->flags &=
+                       ~MPR_TARGET_FLAGS_RAID_COMPONENT;

Build/run

build.log — compile-validated on the audit guest.

DF-4254 VERDICT

status: untested (hardware-gated: no mpr HBA on the audit guest) impact: logic/data-integrity (disk lockout + wrong shutdown handling) confidence: certain (single-token defect, mps twin already acknowledged as DF-1698)

Trace

mpr_sas_lsi.c:590-606: PD-state OFFLINE branch intends to expose a former RAID component to the OS by clearing MPR_TARGET_FLAGS_RAID_COMPONENT, but :598-599 uses |= with the inverted mask — all bits except RAID_COMPONENT get set and RAID_COMPONENT remains set. Consequences:

1. Disk lockout: mprsas_add_device (:909) special-cases targets whose RAID_COMPONENT bit is set (skips ID/reuse validation), and rescan paths treat it as still-owned by the volume — the freshly-exposed phys disk never becomes usable (same user-visible effect the mps twin DF-1698 describes: "locking disk out of OS permanently").
2. Wrong SSU classification: MPR_TARGET_IS_SATA_SSD is force-set; mprsas_ir_shutdown (:1677-1698) maps SSD flag → stop_at_shutdown = FALSE for the enable-HDD profiles — spinning HDDs are not stopped at shutdown, defeating the spin-down-before-power-off protection the whole SSU machinery exists for (potential data loss on power cut).

mps twin: DF-1698 (mps_sas_lsi.c) — identical upstream FreeBSD code, same fix applied there. No mpr-side finding existed (knowns were DF-1473/1474/ 1475 only), so this is filed for the mpr driver.

Fix: &= ~ (fix.diff, compile-validated in build.log). fix_status: not_testable (runtime needs IR-mode HBA + phys-disk state event).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.