2026-10-11 12:07:06 Displayed 57 times

Found a bug in OpenBSD ic/nvme

Confirmed and fixed: NVMe invoked a completion callback after its scsi_xfer had been freed and poisoned with 0xdeadbeef.

Changes:

• Track whether each NVMe CCB is active.
• Retire it when the first completion is consumed.
• Ignore late or duplicate completions before touching the callback.
• Validate CIDs before indexing the CCB array.
• Treat polled-command timeouts as failures and retire their CCB.
• Assert that active CCBs never enter the free pool.
• Leave viommu and ext4fs unchanged.