DF-5012 — VERDICT

Status: REPRODUCED at sink level on the stock audit guest (the exact completion pattern of mfi_disk.c:266-274 demonstrated live); the mfi-specific entry conditions (hw_crit_error, issuepend_done == 0) are hardware-gated (no MegaRAID controller on this guest) and are unconditional control flow in the source — line-traced below.

Impact ceiling: dos — permanent unkillable D-state for any issuer with a bio in flight when the controller faults or resets (OCR). Whole-system hang when mfid carries the root filesystem.

Why the bio leaks (source trace)

1. mfi_disk_strategy() mfi_disk.c:249: bios arrive from the disk layer (dev_dstrategy on the mfid cdev or its slices).
2. mfi_disk.c:266-269: if (controller->hw_crit_error) { bp->b_error = EBUSY; return (0); } — no bp->b_flags |= B_ERROR, no bp->b_resid, no biodone(bio). The caller of a d_strategy owns completion; nobody else holds a reference to this bio. It is leaked into nothing.
3. mfi_disk.c:271-274: identical for controller->issuepend_done == 0. issuepend_done is a per-controller OCR gate: cleared at mfi_tbolt.c:541 when the reset starts, restored at mfi_tbolt.c:1323 when it finishes — the window is the entire OCR (seconds). hw_crit_error is set at mfi_tbolt.c:1222/1288 on fatal PCI/firmware access failure during adapter reset and is never cleared until reattach (mfi.c:388).
4. The issuer (e.g. physio → biowait) sleeps uninterruptibly forever. Contrast the correct pattern 9 lines up (mfi_disk.c:257-263) and the userspace-facing ioctl gate that does return EBUSY (mfi.c:2901-2904).

Guest run (stock kernel, no config changes)

+ ps -o pid,stat,wchan,command -p 1109
   PID STAT   WCHAN    COMMAND
  1109 D3     physstr  /tmp/poc/df5012_trigger wedge /dev/df50120
+ kill -9 1109
+ ps ...          # after SIGKILL, 2 seconds later
  1109 D3     physstr  ...          # STILL ALIVE
+ /tmp/poc/df5012_trigger poke /dev/df50120   # external completion
poke: pread@1M r=512 errno=0
+ ps ...  ->  GONE

dmesg: df5012: LEAKING bio 0xfffff8004f3dfcc0 (off 2097152) -- b_error=EBUSY, return 0, NO biodone then df5012: poke -- completing leaked bio ....

The wedge process survived SIGKILL and terminated only when the leaked bio was completed externally — i.e. the driver-side omission alone is sufficient for the permanent hang. That is precisely the mfi_disk.c:266-274 behavior.

Why not a full hardware trigger

No MegaRAID controller exists on the guest (pciconf -l has no LSI 1000:1960 etc.), and mfi cannot be attached without one. QEMU does ship a megasas device model, but the guest VM is booted from a fixed snapshot with a fixed device set; per the DF-2066 precedent (identical bug, sibling file), the source trace above is the standard of proof for HW-gated driver findings.

Exploit chain

Not applicable (dos class). The primitive is a permanent, unkillable kernel sleep, not memory corruption.

Fix

fix.diff: complete the bio on both paths (B_ERROR + b_resid + biodone) via a fail: label — the same pattern the NULL-si_drv1 path already uses. Validated git apply --check against the audit tree; not built as a single-fix kernel (dos-class, HW-gated entry).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.