# VERDICT — DF-3642

**Status: not_reproduced (runtime) — defect certain (source), upstream-inherited.**

## What I did

1. Read the full 6,117-line file and traced every caller chain into
   `e1000_erase_flash_bank_ich8lan` (see README.md chain: `if_em.c:781/787` →
   `e1000_api.c:1270` → `e1000_ich8lan.c:4395-4403` → `:4214` → `:4246/4252`).
2. Proved the three code defects from the source (`e1000_ich8lan.c:4779`,
   `:4701`+`:4798`, `:4801`) — full extracted lines in `trace.log`.
3. Verified DragonFly made no local edits here: diffed against FreeBSD
   stable/12 (`/tmp/opencode/dfly_vs_fs12.diff`) — all non-whitespace deltas are
   upstream *additions* DragonFly lacks (PCH tgp/adp/mtp/ptp cases, k0s config).
4. Fetched FreeBSD HEAD (`/tmp/opencode/fs_ich8lan.c`, main branch 2026-09-15):
   the accumulation bug is still present at line 4931 — vendor-inherited and
   un-fixed upstream; a DragonFly-side fix is legitimately ours to contribute.
5. Guest verification (`guest_env.txt`): em(4)/ig_hal is compiled into
   X86_64_GENERIC, but the guest has **no Intel GbE MAC** (virtio NIC only,
   `pciconf -l` shows i440FX bridge devices 0x1237/0x7000/0x7010/0x7113, none are
   e1000 LAN). `em_attach` never matches, so the flash-cycle code cannot execute
   on this guest. A hardware-in-the-loop rig (real I217/I218/I219 or an FPGA PCIe
   card emulating one with a flaky flash controller) would be required to observe
   the wrong-sector erase at runtime.

## Why not false-positive

The control flow is unambiguous: the `+=` executes on every pass of the inner
`do/while` (including every `continue` retry), `count` is initialized once at
declaration (`:4701`) and never reset inside the `for (j ...)` loop, and the only
`return` paths before `:4801` are (a) `flash_cycle_init` failure and (b) the
`!flcdone` timeout — exhausting the budget via the `flcerr`/`continue` path falls
through to `return E1000_SUCCESS`. No interpretation required.

## Impact assessment (honest ceiling)

- Not kernel memory corruption: all writes go to the device register FADDR; the
  flash controller enforces region grants, so the BIOS/ME regions are not
  reachable by the GbE master on conforming parts.
- Realistic ceiling: NVM image corruption / NIC config bricking during an
  attach-time repair flow on hardware whose flash reports cycle errors
  (failing/counterfeit part), reachable from NVM content alone.
- Precondition strength is why this is Low, not Medium: needs a specific
  physical device state, not a local user.

## Fix

`fix.diff` (git-apply-able, `git apply --check` verified against the read-only
tree): pin `bank_base_addr` once, recompute the address per attempt, reset the
retry budget per sector, and propagate erase failure instead of returning
success. Fix validation on hardware was not possible on this guest
(fix_status: not_testable; baseline could not be reproduced either).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.