# DF-1059 — FW_SBINDADDR / FW_CBINDADDR NULL deref of ir

## Summary
`fw_ioctl` at `sys/bus/firewire/fwdev.c:443-444` initializes
`ir = d->ir`, populated only by `FW_SRSTREAM`. If a user opens `/dev/fwN`
and issues `FW_SBINDADDR` (`:617`, `fwb->sub = ir->dmach`) or
`FW_CBINDADDR` (`:600`, `STAILQ_REMOVE(&ir->binds, ...)`) without a
prior `FW_SRSTREAM`, `ir` is NULL → kernel NULL deref → panic. Single syscall.

## HW / preconditions
Requires a FireWire PCI host controller (no `fwohci` attachment, no
`/dev/fw*` on this QEMU guest). **Code-confirmed only.**

## Build / Run
No buildable PoC (no `/dev/fw*`). `./build.sh && ./run.sh` print the
situation. The bug is documented in `fw_bindaddr_null_deref.c`.

## Fix
`fix.diff` adds `if (ir == NULL) { err = EINVAL; break; }` at the top of
both `FW_CBINDADDR` and `FW_SBINDADDR`.