# DF-3724 — VERDICT

**Status: inconclusive (no X550 hardware on guest; no in-tree caller of the LED ops). Source-certain defect pattern (DF-3643/3671 family).**

- ixgbe_x550.c:4551-4552 — `ixgbe_read_phy_reg(hw, ..., &phy_data)` return value
  discarded; `phy_data` is an uninitialized stack `u16` (declared :4543).
- ixgbe_x550.c:4553-4555 — `phy_data |= IXGBE_X557_LED_MANUAL_SET_MASK;` then
  `ixgbe_write_phy_reg(...)` persists the uninitialized-derived value into the
  X557 LED provisioning register.
- Mirror at :4576-4580 (`led_off`).
- Contrast with the sibling `ixgbe_get_supported_physical_layer_X550em`
  (:3652-3654) which also ignores the read but initializes
  `ext_ability = 0` (:3621) — the LED functions do not.

## Why Info

No in-tree caller: `rg 'led' if_ix.c` → no LED op dispatch anywhere in the
driver (the ops are wired in `ixgbe_init_ops_X550`:95-99 but only ever invoked
through `ixgbe_api.c` wrappers that if_ix never calls). Reachable only by
future code or ported tools; impact when reached is a PHY misconfiguration
(uncontrolled 16-bit value OR/AND-ed into an LED register), not kernel memory
corruption.

## Verification

- Guest `pciconf -lv` (../DF-3723/env.txt): no X550 → HAL cannot execute.
- `fix.diff` compile-validated on guest `/usr/src` (module build, `-Werror`,
  make_rc=0, see fix_build.log), reverted afterwards (md5 restored).

## Recommended fix

Check both PHY access returns and bail on failure — see `fix.diff`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.