# DF-3671 — VERDICT

**Status: inconclusive (runtime) / source-level certain. Severity Info: no kernel-memory disclosure, decisions-only uninitialized/garbage inputs. DF-3643 parity for the ixgbe HAL.**

## Analysis

The e1000_ich8lan pass-1 lesson (DF-3643: "Unchecked PHY-read return values:
EEE decisions and PHY write-backs derived from uninitialized kernel stack")
applies verbatim to five clusters in the ixgbe shared code; none of them
propagates the read status:

| Site | Discarded return | Downstream use |
|---|---|---|
| ixgbe_common.c:621-628 | 4× `phy.ops.read_reg(...,&i)` | none (counter clear) — benign |
| ixgbe_common.c:1095 | `eeprom.ops.read(EE_CTRL_4, &ee_ctrl_4)` | `bus->instance_id` from uninit stack u16 |
| ixgbe_common.c:278-279 | `phy.ops.read_reg(AN_ADVT, &reg_cu)` | **write-back at :375-376 clobbers PHY advertisement with 0|pause bits on failed read** |
| ixgbe_common.c:3083-3088 | 2× `phy.ops.read_reg` | `ixgbe_negotiate_fc` inputs; 0 inputs silently degrade to `ixgbe_fc_none` |
| ixgbe_common.c:4438 | `eeprom.ops.read(DEVICE_CAPS, device_caps)` | `ixgbe_start_hw_generic` (:397, :430-431) branches on **uninitialized stack** for `need_crosstalk_fix` |

Reachability: all execute during `ix_start_hw`/`ix_setup_fc`/`ix_init` — i.e.,
attach and every interface init on real ixgbe hardware. The reads fail when
the PHY/MDIO bus is wedged, during overtemp resets, or under a hostile PHY —
precisely the states where making config decisions from garbage compounds the
fault.

Impact ceiling: wrong flow-control negotiation, broken link advertisement
(site 3 actively corrupts PHY state), wrong crosstalk-fix enablement. No
userspace-visible memory disclosure → Info, matching DF-3643.

## Upstream fidelity

Function-level diffs against FreeBSD head shared code
(`ixgbe_fc_autoneg_copper`, `ixgbe_setup_fc_generic`) came back IDENTICAL for
these sites — FreeBSD carries the same pattern; this is vendored-code
divergence logging (fix owner: Intel shared code), filed for completeness and
for the local hardening patch.

## Verification performed

Source walk only + fix compile validation (`fix.diff` adds return-value
checks; `build_patched.log` -Werror clean on the guest's md5-identical
`/usr/src`). Runtime reproduction requires a failing PHY on real hardware —
absent on this guest (env.txt). Guest source restored; guest left clean.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.