DF-5027 — ipsd_dump() reports fake success when the poll never completes (ips_disk.c)

File: sys/dev/raid/ips/ips_disk.c (pass 2) Lines: 249-271 (dump loop), 261-264 (COMMAND_ERROR on a zeroed status), 326-336 (completion callback that never runs on copperhead) Class: crash-dump integrity / silent data loss (CWE-252 / CWE-754); sibling of DF-4616 (morpheus poll-window), distinct mechanism (copperhead poll is a stub) and distinct file.

Mechanism (source, deterministic on copperhead)

1. ips_get_free_cmd() hands out a command with status bzero'd (ips.c:232), so COMMAND_ERROR(&command->status) (basic_status 0 < 2) can never fire until a completion fills it.
2. ipsd_dump_map_sg issues the command and calls sc->ips_poll_cmd(command) (ips_disk.c:321-322).
3. On copperhead adapters ips_poll_cmd = ips_copperhead_poll — an unimplemented stub that only kprintfs (ips.c:810-814). No completion is ever delivered; ipsd_dump_block_complete (which would unload the map) never runs.
4. ipsd_dump then checks only COMMAND_ERROR (ips_disk.c:261-264) — sees the zeroed status, judges success, and loops: re-issuing into a command slot the adapter may still own and re-bus_dmamap_loading a map that was never unloaded (undefined per bus_dma(9)).
5. Result: a copperhead crash dump can be an empty/interleaved-corrupt file while every block reported success — forensics/dump confidentiality- relevant integrity loss, silently.

Why not reproduced at runtime

Dump path needs an IPS adapter (absent — env.txt) AND a crash dump. The code chain is unconditional (no timing): stub → zeroed status → false success.

Fix

fix.diff: ipsd_dump_block_complete sets command->completed = 1; the dump loop requires completed != 0 (else EIO + break) and resets the flag per iteration. Copperhead dumps now fail loudly (EIO) instead of lying; morpheus dumps are unaffected (poll delivers the completion). Compile- validated in the patched ips.ko build (-Werror clean).

DF-5027 Verification Verdict

Status: not_reproduced (hardware-gated crash-dump path; code chain deterministic — stub poll + zeroed status + unchecked completion)

Source proof

• ips.c:232 — ips_get_free_cmd bzeroes command->status on handout.
• ips.c:810-814 — ips_copperhead_poll: "cmd polling not implemented for copperhead devices" — kprintf and return; the issued dump command is never completed, ipsd_dump_block_complete (ips_disk.c:326-336) never runs, the data map is never unloaded.
• ips_disk.c:261-264 — the ONLY post-issue check is COMMAND_ERROR(&command->status) on that still-zeroed status → always false → every 64K chunk "succeeds"; command->completed is never consulted.
• Follow-on: ips_disk.c:256-257 re-loads an already-loaded dmamap on the next loop iteration (bus_dma(9) undefined behavior).

Distinction from known findings: DF-4616 covers the morpheus poll window being 10x too short (ips.c timing bug); this finding is the copperhead complete no-op plus ipsd_dump's missing completion check — different adapter, different file, different failure (false success vs short wait).

Not exercisable on this guest

No IBM ServeRAID adapter (env.txt: no 0x1014/0x9005 PCI devices, no /dev/ips*, no ipsd disks); the dump path additionally requires a crash. The defect is unconditional control flow, hence confidence certain in the code; runtime reproduction hardware-gated.

Fix validation

fix.diff (completed-flag handshake) compiled clean as part of the patched ips.ko module build (-Werror, fix_validation.log). Behavioral validation hardware-gated → fix_status not_testable.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.