DF-4309 evidence pack

Source-level finding against sys/dev/disk/advansys/adwcam.c — hardware-gated (guest/QEMU has no Advansys HBA; pciconf shows no vendor 10cd). No runnable PoC exists without the device. See VERDICT.md for the full path:line proof and fix.diff for the validated-shape fix (patch -p1 apply-verified, never applied to sys/).

DF-4309 — adw_free() never destroys the per-ACB buffer DMA maps (attach/detach asymmetry)

File: sys/dev/disk/advansys/adwcam.c — severity Info (resource leak / cleanup asymmetry), bucket base:dev, confidence certain (source).

Root cause

adwallocacbs() creates one buffer DMA map per ACB:

error = bus_dmamap_create(adw->buffer_dmat, /*flags*/0,
              &next_acb->dmamap);        /* adwcam.c:205-206 */

adw_free() (adwcam.c:843-886) unwinds init levels 9→1: it frees the sg maps (case 9), unloads/frees the acb array (cases 8/7) and destroys buffer_dmat itself (case 2, adwcam.c:878) — but never destroys the next_acb->dmamap maps (up to ADW_DEF_MAX_HOST_QNG = 253 of them, adwlib.h:54). Every adw_free() — driver detach / kldunload / failed attach — leaks all per-ACB bus_dma map structures and destroys their tag while the maps are still live.

Impact: kernel resource leak only (repeatable by privileged module load/unload); no direct memory-safety consequence. Filed as Info hardening found by the pass-2 attach-error-path lens.

Reproduction

Hardware-gated (needs Advansys HBA for adw_init to reach adwallocacbs). Guest has none (pciconf -l | grep 10cd → empty). Status untested.

Fix

fix.diff — destroy the per-ACB maps in adw_free() case 9 (before the buffer tag is torn down in case 2). patch -p1 apply-verified.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.