# DF-3580 — VERDICT

**Status: untested.** The `/dev/iwn*` cdev only exists when iwn hardware is
attached; the audit guest is virtio-only. The defect is a two-line logic
inversion visible on read.

## Analysis

`iwn_cdev_ioctl()` (if_iwn.c:5139-5180):

```c
rc = caps_priv_check(..., SYSCAP_NODRIVER | __SYSCAP_NULLCRED);
if (rc != 0)
        return (0);
```

Privilege failure → errno 0 ("success") with the requested action silently
skipped. Privilege success → action performed. Impact assessment:

- No unauthorized access: unprivileged callers receive no data (the
  fail-closed direction).
- The node is 0600 root:wheel (if_iwn.c:776-777) so unprivileged open()
  already fails; the caps check is defense-in-depth whose result is
  misreported.
- Correctness/robustness issue and a hazardous pattern (an inverted
  security-check return is one refactor away from a real bypass), hence
  Info severity, confidence certain (the code is unambiguous).

`SYSCAP_NODRIVER` (sys/sys/caps.h:153) is the DragonFly capability gating
driver ioctls; `__SYSCAP_NULLCRED` only permits the NULL-credential form of
the call.

## Fix

Return the failure code: `return (rc);` (fix.diff).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.