# DF-1059 — FW_SBINDADDR / FW_CBINDADDR NULL deref of ir

## Verdict
**NOT REPRODUCED** — code-confirmed latent bug; cannot trigger on this guest (no FireWire PCI controller, `/dev/fw*` absent).

## Mechanism (source-confirmed)

In `sys/bus/firewire/fwdev.c:fw_ioctl`:

- `:443-444` `ir = d->ir; it = d->it;` — these are populated ONLY by the `FW_SRSTREAM`/`FW_STSTREAM` cases (`:475-503`). On a fresh fd `d->ir == NULL`.
- `:600` `FW_CBINDADDR`: `STAILQ_REMOVE(&ir->binds, fwb, ...)` dereferences `&ir->binds` without a NULL guard.
- `:617` `FW_SBINDADDR`: `fwb->sub = ir->dmach;` dereferences `ir->dmach` without a NULL guard. The preceding checks (`bindreq->len <= 0`, `bindreq->start.hi > 0xffff`) do NOT validate `ir`.

A user opening `/dev/fwN` and issuing `FW_SBINDADDR` (or `FW_CBINDADDR` after a prior successful bind) without a prior `FW_SRSTREAM` causes a NULL page fault → panic. Single syscall.

The `/dev/fw*` device node is created by `make_dev` at `fwdev.c:173-176` with mode `0660` and `GID_OPERATOR`, so this is operator-group reachable on default config when FW HW is present.

## Why not reproduced on this guest

The QEMU audit guest has no FireWire PCI host controller. `kldstat -v` shows the `fwohci/firewire` driver present in the kernel, but with no PCI device to attach to, no `firewire0` instance exists and no `/dev/fw*` device node is created. Therefore `fw_ioctl` is never invoked from userspace on this guest — there is no reachable path to the bug.

Per Phase-4(c)/(d): real bug, unreachable on this guest due to absent HW. Source-only confirmation; the bug is latent and would manifest on a real FireWire-equipped system (or via a software FireWire controller / sbp injection rig).

## Fix

`fix.diff` adds `if (ir == NULL) { err = EINVAL; break; }` at the top of both `FW_CBINDADDR` and `FW_SBINDADDR` cases. Validated as part of a combined 5-patch kernel build that compiled cleanly and booted; the firewire code path is dormant on this guest.

## Kernel references
- `sys/bus/firewire/fwdev.c:443-444` — `ir = d->ir; it = d->it;` initialization
- `sys/bus/firewire/fwdev.c:600` — `FW_CBINDADDR` deref of `&ir->binds`
- `sys/bus/firewire/fwdev.c:617` — `FW_SBINDADDR` deref of `ir->dmach`
- `sys/bus/firewire/fwdev.c:475-503` — only `FW_SRSTREAM`/`FW_STSTREAM` populate `d->ir`

## PoC changes
`fw_bindaddr_null_deref.c` is doc-only. `fix.diff` is git-apply-able and verified to apply + compile as part of a combined patched-kernel build.