DF-4308 evidence pack

Source-level finding against sys/dev/disk/advansys/adwcam.c — hardware-gated (guest/QEMU has no Advansys HBA; pciconf shows no vendor 10cd). No runnable PoC exists without the device. See VERDICT.md for the full path:line proof and fix.diff for the validated-shape fix (patch -p1 apply-verified, never applied to sys/).

DF-4308 — adwprocesserror() panics on firmware-defined host_status codes the switch does not enumerate

File: sys/dev/disk/advansys/adwcam.c — severity Low (panic/DoS), bucket base:dev, confidence certain (source).

Root cause

adwprocesserror() (adwcam.c:1341-1429) maps firmware host-status codes to CAM statuses and ends in:

    default:
        panic("%s: Unhandled Host status error %x",
              adw_name(adw), acb->queue.host_status);   /* adwcam.c:1412-1414 */

acb->queue.host_status is a device-written byte (the RISC's completion verdict, DMA'd into the acb). The switch handles every code up to 0x45 except the four codes the driver's own firmware ABI defines (sys/dev/disk/advansys/adwlib.h:346-354):

• QHSTA_M_DIRECTION_ERR 0x35 — data phase mismatch (a SCSI target can deliberately violate the data-in/data-out phase agreed in the identify; classic malicious/misbehaving-peripheral behavior, also produced by marginal cabling)
• QHSTA_M_DIRECTION_ERR_HUNG 0x36 — same, bus hung
• QHSTA_M_FROZEN_TIDQ 0x46 — TID queue frozen (U160 microcode)
• QHSTA_M_SGBACKUP_ERROR 0x47 — S/G backup error (U160 microcode)

Any of these completing a command → panic() → kernel DoS from device/target-controlled input, exactly the class DF-1548/DF-2411/DF-2415 (CALC_GEOMETRY div0) already established for this driver family, but reachable from ordinary I/O completion rather than geometry setup.

Reproduction

Hardware-gated: needs an Advansys HBA + a target that produces a data-phase mismatch (or firmware emitting 0x46/0x47). Guest has no Advansys hardware (pciconf -l | grep 10cd → empty). Source-level certainty — status untested.

Fix

fix.diff — handle the four codes (DIRECTION_ERR*→CAM_DATA_RUN_ERR, FROZEN_TIDQ→CAM_REQUEUE_REQ, SGBACKUP_ERROR→CAM_DATA_RUN_ERR) instead of panicking. patch -p1 apply-verified.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.