{
  "finding_id": "DF-3671",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain, Info-class (DF-3643 parity): five clusters in ixgbe_common.c discard PHY/EEPROM read return values and act on the (uninitialized or zeroed) outputs — ixgbe_common.c:621-628 (benign), :1095 (instance_id from uninit stack u16), :278-279+375-376 (failed PHY read written back, clobbering the PHY AN advertisement), :3083-3088 (FC negotiation silently degrades to fc_none on failed reads), :4438 + consumer ixgbe_start_hw_generic :397/:430-431 (need_crosstalk_fix decided from uninitialized stack). No kernel-memory disclosure to userspace; decisions only. Upstream FreeBSD shared code is IDENTICAL at these sites (diff verified) — vendored-code issue, filed for hardening. Hardware-gated; guest has no ixgbe device (env.txt). fix.diff checks all five returns; compile-validated -Werror-clean on md5-identical guest source.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (site table with path:line); build_patched.log; env.txt",
  "kernel_refs": ["sys/dev/netif/ix/ixgbe_common.c:621", "sys/dev/netif/ix/ixgbe_common.c:1095", "sys/dev/netif/ix/ixgbe_common.c:278", "sys/dev/netif/ix/ixgbe_common.c:375", "sys/dev/netif/ix/ixgbe_common.c:3083", "sys/dev/netif/ix/ixgbe_common.c:4438", "sys/dev/netif/ix/ixgbe_common.c:430"],
  "poc_changes": "New pass-2 finding, no seed.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src && patch -p1 < fix.diff && cd sys/dev/netif/ix && make obj && make",
  "run_cmd": "n/a (needs failing PHY on real hardware)",
  "code_hash": "6542a0e0ce6fc6d3c84ae5743310a197b55be2a8e39b8ac5c5ad9d550d69ceaf",
  "notes": "Upstream-identical vendored code; recommend also reporting to Intel shared code maintainers. One -Werror iteration was needed while authoring fix.diff (reg_cu error path must goto out).",
  "recommended_fix": "Check every phy.ops/eeprom.ops read return; zero-init *device_caps; skip the PHY write-back when the preceding read failed (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Compile-validated only; runtime validation needs hardware.",
  "fix_evidence": "build_baseline.log / build_patched.log (-Werror clean with fix)."
}