# DF-3643 — unchecked PHY-read return values: decisions and PHY write-backs on uninitialized stack variables

## What / where

`sys/dev/netif/ig_hal/e1000_ich8lan.c` — several PHY register reads ignore the
`hw->phy.ops.read_reg*` return value and then use (and write back) the destination
variable, which is an uninitialized stack `u16` when the read fails:

| site | lines | variable | use after failed read |
|---|---|---|---|
| `e1000_set_eee_pchlan` | 959-968 | `data` (decl. 909, uninit) | branch `data & NWAY_LPAR_100TX_FD_CAPS` selects whether 100M EEE LPI is enabled |
| `e1000_check_for_copper_link_ich8lan` | 1617-1626 | `phy_reg` (decl. 1552, uninit) | masked/OR'd and **written back** to `I217_PLL_CLOCK_GATE_REG` / `HV_PM_CTRL` |
| same | 1765-1772 | `phy_reg` | masked and **written back** to `HV_KMRN_FIFO_CTRLSTA` |
| `e1000_lv_jumbo_workaround_ich8lan` | 2771-2773 | `phy_reg` | OR'd with `(1<<14)` and **written back**; final `:2923` write-back re-enables Rx from the same garbage |
| same | 2837-2859, 2896-2917 | `data` | several read-mask-write RMWs into PHY config |

On read failure the PHY was not written, so the variable keeps whatever was on the
kernel stack; the code then writes that garbage (partially masked) into PHY
analog/config registers or bases an EEE enable decision on it.

## Reachability

- `e1000_check_for_copper_link_ich8lan` runs from the link-status interrupt /
  watchdog path on every link event on PCH hardware (`mac.ops.check_for_link`).
- `e1000_set_eee_pchlan` runs after every link-up for 82579/I217 PHYs
  (`e1000_ich8lan.c:1784-1788`).
- `e1000_lv_jumbo_workaround_ich8lan` runs on MTU changes to >1500 (if_em ioctl path).

A read failure is the precondition (PHY in reset/MDIO error/SMBus-mode transition) —
on healthy hardware rare; on failing or malicious hardware inducible.

## Impact

Uninitialized-kernel-stack-influenced PHY configuration (register write-backs of
stack garbage under masks). The value is never copied to userspace, so there is no
direct info leak; the outcome is a mis-programmed PHY (link instability at worst)
and a KMSAN-class uninitialized-read defect. Severity: Info (hardening).

## Reproduce (source-level)

```
sh findings/poc/DF-3643/trace.sh        # regenerates trace.log with all cited lines
git apply --check findings/poc/DF-3643/fix.diff
```

Runtime reproduction requires Intel PCH GbE PHY hardware whose MDIO reads can be
made to fail; the audit guest has only virtio NICs (see guest_env.txt), so the
defect is proven at source level; identical code exists in FreeBSD HEAD
(upstream-inherited).

## Expected result after fix

Failed PHY reads abort the EEE decision (`goto release`), return an error from the
link-check path, or conservatively use 0-initialized values for RMW chains, so no
decision or write-back is derived from uninitialized stack.