Disk command-list unmap can point at freed host memory
Brief
This is not the surprise-unplug hole.
Notes
a2fbf1785b7a (Denis V. Lunev, 2026-08-17). hw/ide/ahci. Clear cur_cmd when the command list is unmapped. Reported-by Katherine Leaver. The public commit calls that a use-after-free. Resolves issues 3719 and 4043 (issues API 404, treat as non-public). No public CVE id. Trust: guest on q35/AHCI that points the command list at MMIO.
Same pull also d7f16bad8f02 refuse PIO with no command header (also guest disk corruption: first sector written over the second), 795af987ce4c reject invalid FIS length, and 2713717148f5 treat a failed PRDT walk as a transfer failure.
Landed with 324bb5ef83ad Merge tag pull-ide-2026-08-26 (2026-08-26 11:26 PT).
Commit a2fbf1785b7a464d61c0f60c4ad0a86d82925e5d