{
 "finding_id": "DF-2341",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "Verbatim uether_ifdetach (usb_ethernet.c:267-305) driving the REAL in-kernel ether_ifdetach/if_detach on the failure state ue_attach_post_task leaves when mii_phy_probe fails (softc zeroed, ue_tq/lock/unit set up, ether_ifattach never ran, if_link = {NULL,NULL}): the detach machinery dereferences the never-attached ifnet and the kernel panics (fault virtual address = 0x0, if_down_dispatch+0x66 - the first NULL in the detach path, just before the predicted TAILQ_REMOVE). With the ue_if_attached flag the verbatim function skips the ether detach and returns cleanly. Trigger: USB Ethernet adapter (aue/mos/udav-PHY class) with a non-responding PHY, then unplug - reliable kernel DoS.",
 "exploit_chain": "",
 "evidence": "panic.txt (baseline: fault 0x0 at if_down_dispatch), run_fixed_kernel.log (returned WITHOUT panic), rig/dfbatch_uether.c + dfb_uether_shims.h (real usb_ether header, verbatim function), fix.diff",
 "kernel_refs": [
  "sys/bus/u4b/net/usb_ethernet.c:232",
  "sys/bus/u4b/net/usb_ethernet.c:239",
  "sys/bus/u4b/net/usb_ethernet.c:261",
  "sys/bus/u4b/net/usb_ethernet.c:294"
 ],
 "poc_changes": "fabricated softc uses a real lockinit/usb_proc_create/usb_callout_init_mtx sequence so the failure state is exact; crash site is if_down_dispatch rather than the TAILQ_REMOVE itself (documented - same class, earlier NULL in the same detach path)",
 "attempts": 4,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #5 DFBATCH Wed Oct 21 21:27:34 UTC 2026 root:/usr/obj/usr/src/sys/DFBATCH x86_64 (rig kernel); stock baseline #0 X86_64_GENERIC",
 "runtime_sec": 600,
 "guest_dirty": 0,
 "build_cmd": "kernel-compiled rig (DFBATCH)",
 "run_cmd": "sysctl debug.dfbatch.cmd=\"uether mii\"",
 "code_hash": "1d012b28a66f7342d6174015128f8579535dfec3d60709d296a51b9d4fcbacd8",
 "notes": "fix validated A/B on the same rig: baseline behavior gone post-patch (see run_fixed* logs); rig kernel = X86_64_GENERIC + device dfbatch, INVARIANTS kept",
 "recommended_fix": "record ue_if_attached after ether_ifattach and skip the ether detach when absent"
}