# VERDICT — DF-3643

**Status: not_reproduced (runtime) — defect certain (source), upstream-inherited.**

## What I did

1. Enumerated every `hw->phy.ops.read_reg*` call site in the file whose return
   value is discarded and whose destination is consumed afterwards. The five
   clusters above (trace.log) are the complete set; all other read sites either
   check the return or do not use the destination on the error path.
2. Confirmed each destination is genuinely uninitialized at first use on the
   failing path (`data` decl. 909, `phy_reg` decl. 1552 / 2761) — these are
   per-call stack frames, so on repeated watchdog invocations the slot contains
   stale data from the previous call or arbitrary caller frames, i.e.
   non-deterministic kernel-stack content flows into PHY register writes.
3. Verified the code is byte-identical in FreeBSD HEAD (upstream-inherited) and
   that DragonFly's copy is a faithful vendor snapshot (diff vs FreeBSD stable/12
   contains no local edits to these functions).
4. Guest verification (`guest_env.txt`): no Intel GbE MAC on the QEMU guest
   (virtio only), so the PHY paths never execute there; runtime reproduction is
   impossible on this rig. Deterministically forcing `read_reg` failures requires
   real (or emulated-FPGA) PHY hardware.

## Impact ceiling (honest)

- No kernel memory corruption, no userspace info leak (values are only written
  into PHY config registers and used in branches).
- Worst realistic outcome: garbage analog/clock-gate/FIFO config written to the
  PHY while it is in an error state — link flaps/instability, i.e. a robustness
  defect more than a security boundary crossing. KMSAN would flag every site.
- Classified Info (hardening) per the audit rubric.

## Fix

`fix.diff` (git-apply-able, `git apply --check` verified): check the return of the
`PHY_LP_ABILITY` read (EEE decision aborts to `release`), check the
`HV_KMRN_FIFO_CTRLSTA` read (error returned to the link-check caller), check the
`PHY_REG(769,20)` jumbo Rx-disable read, and zero-initialize the RMW chain locals
so any remaining unchecked read degrades to defined defaults. Fix validation on
hardware was not possible on this guest (fix_status: not_testable).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.