[mhellevang]

Split of #213 (merge order):

1. Bound SBP-2 max_payload by link speed, log posted-write fault address #214 Standalone fixes (max_payload, posted-write, rcvPhyPkt)
2. Read bus-reset generation from SelfIDCount, not reserved 0x06C #215 Bus-reset generation from SelfIDCount
3. SBP-2: re-login/reconnect after rediscovery, not on a 100 ms timer #216 Reconnect after rediscovery
4. SBP-2: carry command data by OHCI physical DMA #217 Physical DMA, needs 2+3
5. SBP-2: bus reset only when a logout with a command outstanding fails #218 Recovery/teardown policy, needs 4 ← this PR
6. SBP-2: DMA HBA task data in place via fBufferIOVMAddr #219 Zero-copy, needs 5

---

Recovery/teardown policy, on top of #217; draft until that lands. The diff shows #217's commits until then.

#217 already keeps a released command's buffer until the logout status and never resets on client exit. What was left open there: a logout that is rejected synchronously or times out freed the parked buffer without any confirmation that the target had stopped. This closes it the way your item 1 asked: on a failed or unanswered logout with a command outstanding, request a bus reset and keep the command parked until OnBusReset frees it. A failed logout with nothing outstanding changes nothing. This is the only reset the release path asks for.

Not changed, on purpose: the task's completion to the HBA still happens at release (the buffer is ours, not the caller's), so dext teardown never waits on a logout. Dext teardown itself clears the physical request filter before the bridge releases its sessions (ExecuteRuntimeTeardown) and tells the registry (PrepareForTeardown), so a logout that fails on a bus going down asks for no reset and the parked command goes with the registry. That came out of a sleep-mid-scan run on the zero-copy branch, where the reset request fired in the middle of the quiesce. The timeout → LUN reset → bus-reset escalation for an unfetched LUN reset stays as on main.

Host tests: LogoutFailureTest (rejected and timed-out logout both request one reset, keep the buffer, free it at the reset) plus the existing parked-command tests. HW: the paths here are a target that drops off the bus mid-command; covered by the power-cycle-mid-READ run on #217 for the reset edge, the failed-logout edge itself needs a device that ignores logout, which I can't produce on demand.