# DF-3725 — VERDICT

**Status: inconclusive at runtime (no X550 hardware on guest). Source-certain error-propagation defects (DF-3671 family).**

## Root cause

The five call sites listed in README.md assign an MMIO/MDIO write result to a
status variable and then unconditionally overwrite it (or never read it),
so `IXGBE_SUCCESS` is returned for operations that failed. The strongest
instance is ixgbe_x550.c:4207-4212: after programming the pause
advertisement into KRM_AN_CNTL_1, the write status is dropped and the
function returns whatever `ixgbe_restart_an_internal_phy_x550em()` returns —
a failed FC-config write (e.g. IOSF completion error, reported by
`ixgbe_iosf_wait` at :1118-1121) is reported to the caller as success.

## Bounds of impact

- No kernel memory unsafety (all writes are to device registers through
  checked-width register macros).
- Trigger is physical (link flap / cable insert calling setup_link paths via
  `ixgbe_handle_mod`, `ixgbe_setup_link`), or driver init. A mis-programmed
  advertisement can wedge the link until the next reset — availability only.
- Upstream-identical (Linux master / FreeBSD head carry the same drops), so
  this is shared-code hygiene, not a DragonFly regression.

## Verification

- Guest has no Intel 10G NIC (../DF-3723/env.txt) — cannot execute the path.
- `fix.diff` compile-validated on guest `/usr/src` module build with
  `-Werror` (`DF-3725_make_rc=0`, ../DF-3724/fix_build.log), reverted after.

## Recommended fix

`fix.diff` (check-and-return after each dropped write; propagate `rc` in
`ixgbe_setup_sgmii_fw`).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.