# DF-3724 — ixgbe_led_{on,off}_t_X550em: PHY register read return ignored → uninitialized stack word masked and written back to the PHY

**File:** `sys/dev/netif/ix/ixgbe_x550.c:4541-4559, 4566-4584`
**Severity:** Info (latent — LED ops have no caller in if_ix.c) **Confidence:** certain (DF-3643/3671 parity)

`ixgbe_read_phy_reg()` (MDIO over SWFW+token semaphore) can fail (IXGBE_ERR_PHY /
SWFW_SYNC / MDIO timeout). Both LED functions ignore the return and then compute
`phy_data |= / &= ~MASK` on the **uninitialized** stack `u16 phy_data` and write it
into X557 LED_PROVISIONING. DF-3643/3671 family (failed read → garbage write-back).

- Dead in-tree: `if_ix.c` never calls `led_on`/`led_off` (verified: no caller of
  `hw->mac.ops.led_*` or `ixgbe_led_*` in the driver); op is exported shared-code
  surface for future/tools callers.
- Not runtime-verifiable: guest has no X550 NIC (see ../DF-3723/env.txt).
- `fix.diff` (status checks + `s32 status` decl) compile-validated on guest
  `/usr/src` module build with `-Werror` — see `fix_build.log`.