DF-4351 — panic() on device-fed completion status bytes (DF-4042/DF-4308 family, narrow twin)

Build / Run (guest model)

cc -O2 -Wall -o df4351 df4351.c
./df4351

Expected: 14 of 30 tabulated device-fed values lead to kernel panic, including q_status = QS_DONE|QS_DISC1 (0x82) — a legitimate ABI combination (QS_DISC1/QS_DISC2 are defined queue-state bits, advlib.h:565-566) — and host_stat codes the driver itself enumerates (QHSTA_D_LRAM_CMP_ERROR 0x81, QHSTA_M_MICRO_CODE_ERROR_HALT 0xA1).

Root cause

• advansys.c:1092-1094 — panic unless the raw LRAM q_status byte is exactly QS_DONE or has QS_ABORTED set (copied unmasked by adv_copy_lram_doneq, advlib.c:816-818).
• advansys.c:1235-1237 — adv_done default arm panics on host_stat codes outside the handled set, including codes the switch itself lists only to panic on.

Hostile/corrupt SCSI peripheral or buggy firmware → instant kernel panic from an ordinary completion. Same family as DF-4042 (amd.c) and DF-4308 (adwcam.c), both accepted at Low for this threat model.

Fix

fix.diff (git apply --check clean): log + complete with error instead of panicking at both sites.

DF-4351 VERDICT

Status: untested (kernel path) — code defect certain; guest model replays the exact panic predicates.

Root cause (line-accurate)

Two unconditional panic() sites gated only on adapter-written LRAM bytes:

1. sys/dev/disk/advansys/advansys.c:1092-1094 if ((scsiq.q_status != QS_DONE) && (scsiq.q_status & QS_ABORTED) == 0) panic("adv_qdone: completed scsiq with unknown status"); q_status is copied verbatim from LRAM by adv_copy_lram_doneq (advlib.c:816-818, no masking). The driver's own queue-state ABI (advlib.h:562-569) defines QS_DISC1 (0x02)/QS_DISC2 (0x04); a completion byte of QS_DONE|QS_DISC1 (0x82) — a state the firmware can legitimately write for a reconnected command — is an instant panic. Any corrupt LRAM byte without QS_ABORTED likewise.

2. advansys.c:1227-1237 — adv_done's inner switch routes QHSTA_D_QDONE_SG_LIST_CORRUPTED (0x21), QHSTA_D_ASC_DVC_ERROR_CODE_SET (0x22), QHSTA_D_HOST_ABORT_FAILED (0x23), QHSTA_D_EXE_SCSI_Q_FAILED (0x24), QHSTA_D_ASPI_NO_BUF_POOL (0x26), QHSTA_M_BAD_TAG_CODE (0x46), and — although the driver's ABI enumerates them — QHSTA_D_LRAM_CMP_ERROR (0x81) and QHSTA_M_MICRO_CODE_ERROR_HALT (0xA1) into panic("%s: Unhandled Host status error %x"), plus every undefined value.

Consequence: an ordinary I/O completion carrying any of these device-written bytes takes the whole system down. Family precedent: DF-4042 (amd.c, MESSAGE REJECT panic) and DF-4308 (adwcam.c, four unhandled host_status codes) — both accepted, Low severity for the hostile-peripheral threat model.

Verification

• Kernel path untestable on the guest (no AdvanSys HBA; env.txt).
• Guest model df4351.c (cc 8.3; build.log/run.log) tabulates the two predicates verbatim over the device-fed value domains: 14/30 values panic, including the two "legitimate ABI bits" rows (0x82/0x84) and the two enumerated-but-panicking host codes (0x81/0xA1).

Fix validation

Kernel-level validation impossible on this guest. fix.diff (git apply --check clean) replaces both panics: site 1 logs and falls through to normal completion-with-error handling (adv_done's default: arm at :1248-1253 already maps unknown done_stat to CAM_REQ_CMP_ERR, so no control-flow hazard); site 2 reports via xpt_print_path and sets CAM_REQ_CMP_ERR, matching the handling of QHSTA_M_AUTO_REQ_SENSE_FAIL.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.