# DF-3664 — bge_nvram_getbyte leaks NVRAM SWARB lock + access-enable on error paths

## Build / Run / Expected

```
./build.sh          # cc -O -Wall -o trigger trigger.c   (in a DragonFly guest)
./run.sh            # runs the trigger + records the guest-side reachability proof
```

**Expected on real BCM5906 hardware** (NOT available in this environment):
an NVRAM read that times out (grant timeout at if_bge.c:557 or read-done
timeout at if_bge.c:574) returns while `BGE_NVRAMSWARB_SET1` is still
latched and `BGE_NVRAMACC_ENABLE` is still set; the flash arbiter stays
held by the driver for its lifetime, starving ASF/management firmware of
NVRAM access. Device-side functional DoS only — no host memory-safety
impact.

**Actual on the audit guest**: no Broadcom PCI device exists (virtio-net
only), so `bge_attach`/`bge_nvram_getbyte` are unreachable — the trigger
builds clean and prints its hardware-precondition notice (run.log).
Verification is therefore honestly **inconclusive** (source-visible
asymmetry; see VERDICT.md).

## Files
- `trigger.c` — annotated hardware-precondition trigger
- `run.log` — guest proof: `pci/if_bge` compiled into the kernel,
  `NO_BROADCOM_DEVICE`, `sysctl hw.bge` unknown, /usr/src md5 == audited
  tree, clean build, trigger output
- `fix.diff` — git-apply-able release/restore on both error paths
  (mirrors the paired success-path cleanup at if_bge.c:584-589)
- `verdict.json` / `manifest.json` — machine verdict