# DF-3762 — Unchecked PHY-read returns in e1000_phy.c (DF-3643/DF-3671 family)

File: `sys/dev/netif/ig_hal/e1000_phy.c` (pass 2, GLM 5.3)

## What

The shared e1000 PHY layer consumed by em(4)/emx(4)/igb(4) makes
configuration decisions — and writes registers back — based on PHY reads
whose return values are dropped. When an MDIC/I2C read fails
(`-E1000_ERR_PHY`), the callee returns **without writing `*data`**, and the
caller branches on uninitialized kernel stack or writes a zeroed value back
over live PHY configuration.

Cluster members (all in e1000_phy.c):

| line | function | defect |
|------|----------|--------|
| 3848 | `e1000_link_stall_workaround_hv` | `read_reg(PHY_CONTROL, &data)` unchecked; `data` (decl. 3840) is uninitialized stack; `if (data & PHY_CONTROL_LB)` at 3849 decides on garbage. Runtime-reachable: called from `e1000_ich8lan.c:1755` (`cfg_on_link_up`) on 82578/PCH link-up. |
| 3503 | `e1000_power_up_phy_copper` | void fn; read return dropped; on failure writes `0 & ~MII_CR_POWER_DOWN` back to PHY_CONTROL, zeroing speed/duplex/AN config (link clobber on error path). |
| 3521 | `e1000_power_down_phy_copper` | same pattern with `MII_CR_POWER_DOWN` set. |
| 3075 | `e1000_determine_phy_address` | `e1000_get_phy_id(hw);` return dropped; stale/partial `phy->id` feeds PHY-type dispatch. |
| 2918-2984 | `e1000_phy_init_script_igp3` | all 30+ `write_reg` returns dropped. |

Severity Info — matches the precedent classification of the same family in
DF-3643 (e1000_ich8lan.c) and DF-3671 (ixgbe_common.c). No kernel memory is
leaked to userspace and no OOB occurs; the impact is wrong control flow /
PHY misconfiguration from uninitialized kernel stack plus an error-path
link DoS. This is Intel shared code inherited upstream.

## Build / Run (logic replication — no e1000 hardware needed)

```
./build.sh   # cc -O2 -Wall -o trigger trigger.c
./run.sh     # ./trigger ; exit 1 == uninitialized-data decision demonstrated
```

Built and run on the audit QEMU guest (host has no compiler) — see
`build.log` / `run.log`. Note the compiler's own proof: after inlining the
failing read shim, GCC emits `warning: 'data' is used uninitialized in this
function [-Wuninitialized]` for the replicated decision.

## Why not executed against the real kernel path

The guest is virtio-only: its only NIC is `virtio_pci` (class 0x020000,
chip 0x10001af4) and its only GPU is virtio-gpu. em/emx/igb are statically
registered in the guest kernel, but with no e1000 device the PHY-layer code
under audit cannot run. See `module_presence.log` / `env.txt`.

## Fix

Check every `read_reg`/`get_phy_id`/`write_reg` return; bail out on failure
(see fix sketch in VERDICT.md).