{
  "finding_id": "DF-3642",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Source-certain defect, runtime-untestable on this guest. e1000_erase_flash_bank_ich8lan accumulates the flash erase address inside the per-attempt retry loop (e1000_ich8lan.c:4779), never resets the shared retry budget across sectors (:4701/:4798), and returns E1000_SUCCESS after retry exhaustion (:4801), so flash-cycle errors redirect erases to progressively wrong sectors and erase failures are reported as success; reached at driver attach from NVM content alone via em_attach -> e1000_validate_nvm_checksum -> update -> erase (if_em.c:781, e1000_ich8lan.c:4395-4403,4246/4252). Byte-identical in FreeBSD HEAD (vendor-inherited). The QEMU guest compiles em(4)/ig_hal into GENERIC but has no Intel GbE MAC (virtio only, pciconf verified), so no runtime trigger exists; hardware-in-the-loop required. No kernel memory impact - FADDR writes and flash-controller region grants bound the blast radius to NVM content (NIC config integrity/availability).",
  "exploit_chain": "",
  "evidence": "trace.log (extracted cited lines incl. the accumulation and unconditional success); guest_env.txt (module-in-kernel + no e1000 hardware); fix.diff (git apply --check clean); VERDICT.md (full reasoning + upstream diff)",
  "kernel_refs": [
    "sys/dev/netif/ig_hal/e1000_ich8lan.c:4779",
    "sys/dev/netif/ig_hal/e1000_ich8lan.c:4798",
    "sys/dev/netif/ig_hal/e1000_ich8lan.c:4801",
    "sys/dev/netif/ig_hal/e1000_ich8lan.c:4246",
    "sys/dev/netif/ig_hal/e1000_ich8lan.c:4395",
    "sys/dev/netif/em/if_em.c:781"
  ],
  "poc_changes": "n/a - no seeded PoC; evidence pack built from scratch as a source-level trace + upstream-identity proof",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "git apply --check findings/poc/DF-3642/fix.diff",
  "run_cmd": "sh findings/poc/DF-3642/trace.sh",
  "code_hash": "81bbec20da37c6a0771aee994c6c14543f6b6a70f305b9c2be673726a7ab3e30",
  "notes": "Guest hardware check: kldload if_em reports already loaded or in kernel (static GENERIC code - live on every real Intel-PCH machine), pciconf shows only virtio NIC + i440FX bridge devices, so em_attach never probes. Defect persists in FreeBSD HEAD line 4931 (fetched 2026-09-15) - upstream-contributable fix. Impact ceiling: NVM/flash content corruption (wrong-sector erase) during attach-time checksum repair on flaky/malicious flash; BIOS/ME regions protected by flash-controller grants.",
  "recommended_fix": "Pin the bank base address once and recompute flash_linear_addr = bank_base + j*sector_size per attempt; reset the retry counter per sector; propagate erase failure instead of returning E1000_SUCCESS.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Not testable on this guest: baseline requires an Intel ICH8/PCH GbE MAC with a flash controller that reports cycle errors; the QEMU guest has none. fix.diff verified to apply cleanly against the read-only sys/ tree (git apply --check) and was reviewed against the erase state machine line-by-line.",
  "fix_evidence": "findings/poc/DF-3642/fix.diff; git apply --check output recorded in VERDICT.md; guest_env.txt (hardware absent)"
}