CRITICAL F1.1 from NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
§3.3: xHCI acknowledge() called state.finish() BEFORE releasing the
event TRB. A re-entrant waker.wake() from the future could re-enter the
reactor and re-match the same event TRB against a different state that
happens to overlap in address range, causing wrong-state-match.
Fix: call trb.reserved(false) BEFORE every state.finish() call site in
acknowledge() and acknowledge_failed_transfer_trbs(). This ensures
the event TRB is no longer in the live state set when the future
re-wakes, so a re-entrant wake cannot re-match this TRB.
Touches 4 call sites in irq_reactor.rs:
- StateKind::CommandCompletion match arm
- StateKind::Transfer match arm (transfer match)
- StateKind::Transfer 'dead ring' branch
- StateKind::Other match arm
- acknowledge_failed_transfer_trbs function
Red Bear OS
51ae15674a