# DF-2306 — Unconditional PCI vendor/device ID console disclosure in probe

Verification pack for finding DF-2306 (`sys/bus/firewire/fwohci_pci.c:190-191`).
Info / kernleak. Claim: the generic-class fallthrough in `fwohci_pci_probe`
prints the PCI vendor and device IDs to the console with `device_printf`
unconditionally — no `bootverbose`/`firewire_debug` guard — for every
1394-OHCI controller not in the hard-coded ID table.

## Verdict (short)

REPRODUCED line-accurately and mechanically: the REAL `fwohci_pci_probe`
(verbatim TU rig) invoked with a fabricated PCI identity of
class=0x0c/0x00/progif=0x10 (generic 1394 OHCI) and vendor/device
(0x1a2b/0x3c4d) NOT in the table, fell through to the class match and
printed `fwohci6: vendor=1a2b, dev=3c4d` to the console, set the
description, and returned 0. On real hardware this line appears on every
boot for any OHCI controller absent from the ID table (the table has 25
entries; plenty of controllers, e.g. many TI/NEC/Lucent revs and all
newer chips, fall through). Info-severity: PCI IDs are semi-public
hardware identifiers, but they do fingerprint the exact controller and
the print is unconditional boot noise; the specific-ID matches above
print nothing.

## Files

Same rig as DF-2304 (shared verbatim-interposition harness):
* `fwpci_harness.c/h`, `fwohci_harness.c/h`, `fwpcictl.c` — rig
* `run.sh` — `fwpcictl probe 0x1a2b 0x3c4d 0x0c 0x00 0x10` + dmesg check
* `run.log` — baseline console output (the disclosure line)
* `run_fixed.log` — fixed kernel: silent at bootverbose=0, prints at 1
* `fix.diff` — combined 3-hunk fix (hunk 1 guards the print)

## Reproduce

```
scp -F dfbsd-qemu/config * dfbsd:/root/fwo/
vm.sh run_root 'sh /root/fwo/fwpci_prep.sh && sh /root/fwo/build_kernel.sh'
vm.sh down && vm.sh up
vm.sh run_root 'sh /root/fwo/run.sh'      # dmesg shows: fwohci6: vendor=1a2b, dev=3c4d
```