# DF-1206 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** certain

## Finding
alc_attach checks stale error variable instead of resource pointer, NULL-deref on alloc failure

## Source Location
sys/dev/netif/alc/if_alc.c:1361-1487

## Verdict
Source-confirmed: alc_attach checks stale error variable instead of resource pointer, NU. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
alc_attach() at if_alc.c:1348 initializes error=0 but checks it at :1363/:1484 after bus_alloc_resource_any() which returns NULL on failure and never writes to error. Both if(error!=0) guards are dead code. On failure, rman_get_bustag(NULL) at :1367 dereferences NULL resource -> kernel panic. Same for IRQ at :1482-1487. Reachable whenever rman cannot satisfy BAR/IRQ allocation (resource exhaustion, hot-unplug, PCI error). Fix: check sc->alc_res==NULL / sc->alc_irq==NULL, set error=ENXIO.