== [1] MP_ReadOtherFunPciEConfigSpace returns constant 0xffffffff ==
9:        u_int32_t RetVal = 0xffffffff;
29:        return RetVal;
== [2] DASH type-3 CMAC mapping is gated on the broken read ==
                        CmacMemPhysAddress = MP_ReadOtherFunPciEConfigSpace(sc, 0, 0xf018);
                        if (!(CmacMemPhysAddress & BIT_0)) {
                                if (bus_space_map(sc->re_mapped_cmac_tag, CmacMemPhysAddress, RE_REGS_SIZE, 0,
                                                  &cmac_ioaddr))
                                        sc->re_dash = 0;
                                else
                                        sc->re_mapped_cmac_handle = cmac_ioaddr;
== [3] MACFG_70-72 unconditionally inherit the NULL handle ==
        case MACFG_70:
        case MACFG_71:
        case MACFG_72:
                sc->re_cmac_handle = sc->re_mapped_cmac_handle;
                sc->re_cmac_tag = sc->re_mapped_cmac_tag;
                break;
== [4] re_exit_oob calls Dash2DisableTxRx for MACFG_70-72 at attach ==
        switch(sc->re_type) {
        case MACFG_61:
        case MACFG_62:
        case MACFG_67:
        case MACFG_70:
        case MACFG_71:
        case MACFG_72:
                Dash2DisableTxRx(sc);
                break;
== [5] Dash2DisableTx derefs the CMAC handle, !re_dash guard commented out ==
static void Dash2DisableTx(struct re_softc *sc)
{
        //if (!sc->re_dash) return;

        if (HW_DASH_SUPPORT_TYPE_2(sc) || HW_DASH_SUPPORT_TYPE_3(sc)) {
                u_int16_t WaitCnt;
                u_int8_t TmpUchar;

                //Disable oob Tx
                RE_CMAC_WRITE_1(sc, RE_CMAC_IBCR2, RE_CMAC_READ_1(sc, RE_CMAC_IBCR2) & ~(BIT_0));
                WaitCnt = 0;
== [6] HwSuppDashVer==3 exactly for MACFG_70/71/72 ==
        case MACFG_70:
        case MACFG_71:
        case MACFG_72:
                sc->HwSuppDashVer = 3;
                break;
== [7] DragonFly CMAC macros are raw bus_space calls (no guard) ==
#define RE_CMAC_WRITE_1(sc, reg, val)	\
	bus_space_write_1(sc->re_cmac_tag, sc->re_cmac_handle, reg, val)
#define RE_CMAC_WRITE_2(sc, reg, val)	\
	bus_space_write_2(sc->re_cmac_tag, sc->re_cmac_handle, reg, val)
#define RE_CMAC_WRITE_4(sc, reg, val)	\
	bus_space_write_4(sc->re_cmac_tag, sc->re_cmac_handle, reg, val)
#define RE_CMAC_READ_1(sc, reg)		\
	bus_space_read_1(sc->re_cmac_tag, sc->re_cmac_handle, reg)
#define RE_CMAC_READ_2(sc, reg)		\
	bus_space_read_2(sc->re_cmac_tag, sc->re_cmac_handle, reg)
#define RE_CMAC_READ_4(sc, reg)		\
	bus_space_read_4(sc->re_cmac_tag, sc->re_cmac_handle, reg)
== [8] x86_64 bus_space_read_1 memory variant = direct pointer deref ==
bus_space_read_1(bus_space_tag_t tag, bus_space_handle_t handle,
		 bus_size_t offset)
{

	if (tag == X86_64_BUS_SPACE_IO)
		return (inb(handle + offset));
	return (*(volatile u_int8_t *)(handle + offset));
== [9] collateral: live RMW consumers of the broken read ==
5765:                Data32 = MP_ReadPciEConfigSpace(sc, 0x870c);
5806:                Data32 = MP_ReadPciEConfigSpace(sc, 0x870c);
5938:                Data32 = MP_ReadPciEConfigSpace(sc, 0x870c);
5982:                Data32 = MP_ReadPciEConfigSpace(sc, 0x870c);
6059:                Data32 = MP_ReadPciEConfigSpace(sc, 0x870c);
6125:                Data32 = MP_ReadPciEConfigSpace(sc, 0x870c);
6227:                Data32 = MP_ReadPciEConfigSpace(sc, 0x870c);
6318:                Data32 = MP_ReadPciEConfigSpace(sc, 0x870c);
6383:                Data32 = MP_ReadPciEConfigSpace(sc, 0x870c);
6470:                Data32 = MP_ReadPciEConfigSpace(sc, 0x870c);
6585:                Data32 = MP_ReadPciEConfigSpace(sc, 0x870c);
6598:                        Data32 = MP_ReadPciEConfigSpace(sc, 0x2710);
6792:                Data32 = MP_ReadPciEConfigSpace(sc, 0x870c);
6952:                Data32 = MP_ReadPciEConfigSpace(sc, 0x870c);
                Data32 = MP_ReadPciEConfigSpace(sc, 0xF108);
                Data32 |= BIT_20;
                MP_WritePciEConfigSpace(sc, 0xF108, Data32);
                        if (sc->re_dash && !(MP_ReadByteFun0PciEConfigSpace(sc, 0x79) & BIT_0))
== [10] live call-in from the real driver (if_re.c attach) ==
740:	rtl_init_software_variable(sc);
772:	rtl_exit_oob(sc);
ALL CHAIN LINKS VERIFIED