# DF-2306 VERDICT — unconditional vendor/device ID print in probe fallthrough

* finding: DF-2306, fwohci_pci.c:190-191 (fwohci_pci_probe)
* status: **reproduced** (the exact print behavior demonstrated through
  the verbatim probe function)
* impact: leak (hardware-identifying console disclosure; Info severity —
  PCI IDs are enumerable by other means by anyone with local access to
  the bus, but the print is unconditional and unguarded)
* confidence: certain

## Line-accurate analysis

fwohci_pci.c:187-194: after the 25-entry hard-coded ID table fails to
match, the generic class check
`pci_get_class==PCIC_SERIALBUS && subclass==PCIS_SERIALBUS_FW &&
progif==PCI_INTERFACE_OHCI` executes
`device_printf(dev, "vendor=%x, dev=%x\n", pci_get_vendor(dev),
pci_get_device(dev));` with NO guard — then sets the description and
returns 0. Every specific-ID match above prints nothing. The driver has
no other probe-time print. Sibling style in the same file: probe-time /
attach-time noise elsewhere is guarded by `if (bootverbose)`
(fwohci_pci.c:261-262) or `if (firewire_debug)` (fwohci_pci.c:238).

## Mechanical reproduction (this run)

`fwpcictl probe 0x1a2b 0x3c4d 0x0c 0x00 0x10` drives the REAL
fwohci_pci_probe on the rig shell (parent = fabricated pci bus kobj
serving BUS_READ_IVAR). Console/dmesg:

```
FWP: PROBE vendor=1a2b device=3c4d class=0c subclass=00 progif=10 -> REAL fwohci_pci_probe(0xffffffff817b14c0)
fwohci6: vendor=1a2b, dev=3c4d
FWP: PROBE returned 0 desc="1394 Open Host Controller Interface"
```

The disclosure line is emitted by the stock code path; rc=0 and the
description are set as in a real boot. (No 1394 hardware exists on the
guest — the print targets the fabricated identity; the code path is
byte-identical to what a fall-through controller hits at every boot.)

## Fix validation (A/B)

fix.diff hunk 1 wraps the print in `if (bootverbose)` (sibling style).
Fixed kernel (run_fixed.log):
* bootverbose=0 -> probe returns 0, description set, NO console line.
* bootverbose=1 (rig sets the kernel variable) -> the line prints.
Baseline vs fixed: unconditional print vs bootverbose-gated.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.