{
  "finding_id": "DF-3724",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ixgbe_led_on_t_X550em/ixgbe_led_off_t_X550em discard the ixgbe_read_phy_reg() return and write back a masked uninitialized stack u16 into the X557 LED provisioning register (ixgbe_x550.c:4551-4555, 4576-4580) — DF-3643/3671 family. Runtime inconclusive: guest has no X550 NIC and if_ix.c never dispatches the LED ops (latent). Contrast: ixgbe_get_supported_physical_layer_X550em:3652 ignores its read too but pre-initializes ext_ability=0.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (path:line trace); fix_build.log (fix.diff compiles clean, -Werror, make_rc=0); ../DF-3723/env.txt (no X550 on guest)",
  "kernel_refs": ["sys/dev/netif/ix/ixgbe_x550.c:4551", "sys/dev/netif/ix/ixgbe_x550.c:4554", "sys/dev/netif/ix/ixgbe_x550.c:4576", "sys/dev/netif/ix/ixgbe_x550.c:4579"],
  "poc_changes": "n/a (source-level)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (X86_64_GENERIC)",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "",
  "notes": "Latent (no in-tree caller). Fix compile-validated on guest /usr/src module build.",
  "recommended_fix": "Check the ixgbe_read_phy_reg/ixgbe_write_phy_reg returns in both LED functions and return on failure (fix.diff)",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (adds s32 status + early returns) applied to guest /usr/src; if_ix.ko module rebuild clean under -Werror (fix_build.log, DF-3724_make_rc=0); reverted after. Runtime validation impossible (no hardware).",
  "fix_evidence": "fix_build.log: DF-3724_make_rc=0 with linking line; md5 restored to baseline"
}