# DF-3671 — ixgbe_common.c: unchecked PHY/EEPMD read returns feed config decisions from uninitialized/zeroed state

**File:** `sys/dev/netif/ix/ixgbe_common.c` · **Severity:** Info (hardening; DF-3643 parity) · **Class:** error-handling discipline

## Sites (all upstream-identical vendored shared code; no divergence found)

1. `ixgbe_clear_hw_cntrs_generic` **ixgbe_common.c:621-628** — four
   `hw->phy.ops.read_reg(..., &i)` calls with discarded return values (X540/
   X550 path). On failure nothing is decided from them (results unused), so
   impact is nil here; included for completeness.
2. `ixgbe_set_lan_id_multi_port_pcie` **:1095** — `hw->eeprom.ops.read(hw,
   IXGBE_EEPROM_CTRL_4, &ee_ctrl_4)` unchecked; on failure `ee_ctrl_4` is an
   uninitialized stack u16 used to derive `bus->instance_id` (CS4227 MAC
   instance selection) — config from garbage.
3. `ixgbe_setup_fc_generic` **:278-279** — copper path reads the PHY AN
   advertisement with the return discarded; `reg_cu` stays 0 and is then
   **written back** to `IXGBE_MDIO_AUTO_NEG_ADVT` at **:375-376** after OR-ing
   in pause bits — a failed read turns into a PHY register clobber that
   silently drops all non-FC advertisement bits (link renegotiation
   breakage).
4. `ixgbe_fc_autoneg_copper` **:3083-3088** — two unchecked PHY reads whose
   (zero-initialized) results feed `ixgbe_negotiate_fc`; zero inputs happen
   to be rejected there (`!(adv_reg)` check at 2953), so failure degrades to
   `fc_none` instead of an explicit error — silent misconfiguration.
5. `ixgbe_get_device_caps_generic` **:4438** — unchecked EEPROM read; the
   caller `ixgbe_start_hw_generic` (**:397/:430-431**) passes the address of
   an **uninitialized stack u16** and then tests
   `device_caps & IXGBE_DEVICE_CAPS_NO_CROSSTALK_WR` — the crosstalk-fix
   decision (`hw->need_crosstalk_fix`) is made from uninitialized kernel
   stack memory.

No path returns these values to userspace, so this is a correctness/hardening
defect, not a leak — same classification as DF-3643 (Info).

## PoC / verification

Hardware-gated (PHY/EEPROM read failures need a malfunctioning or malicious
NIC/PHY). No runnable PoC; guest has no ixgbe device (`env.txt`).
`fix.diff` checks all five return values (device_caps zero-initialized +
error propagation, PHY reads bailing with `IXGBE_ERR_PHY`, skipped write-back
on failed read) and compile-validates on the guest's md5-identical source
(`build_patched.log`, `-Werror` clean).