# DF-3827 VERDICT

## Bottom line

**Source-certain unchecked-return defect; kernel-path reproduction
impossible on this guest (no Intel PHY hardware); `not_reproduced`.**

## Trace

`e1000_set_d0_lplu_state_82575()` — `sys/dev/netif/ig_hal/e1000_82575.c`:

- 821-823: read `IGP02E1000_PHY_POWER_MGMT` into `data`, **checked**.
- `active` branch:
  - 827-830: write back POWER_MGMT with D0_LPLU set, checked.
  - **833-834: read `IGP01E1000_PHY_PORT_CONFIG` into `data` — return value
    never inspected.**
  - 835: `data &= ~IGP01E1000_PSCFR_SMART_SPEED;`
  - 836-837: write `data` to `IGP01E1000_PHY_PORT_CONFIG` (return value of
    the read is overwritten by the write's).
- `!active` branch: both reads (851, 864) **are** checked with
  `if (ret_val) goto out;`.

On a failed read at 833 the callee (`e1000_read_phy_reg_igp` /
`e1000_read_phy_reg_mdic` via the dispatch at 220-222) leaves `data`
untouched (and typically returns `-E1000_ERR_PHY` / MDIC ready-timeout), so
the stale POWER_MGMT value from 821 is masked and committed to
PORT_CONFIG. That register controls interface mode / SmartSpeed for the
IGP03/IGP04 PHYs; corrupting it during an LPLU transition degrades or drops
the link until the next PHY reset. No kernel memory is affected — this is a
config-integrity bug on the device, the same class as the ich8lan
unchecked-PHY-read family (DF-3643), hunted here per checklist item (b).

## Why not reproduced

The path requires: (1) an attached 82575/82576/i350-class NIC (dispatch
`e1000_init_function_pointers_82575` only runs from the igb(4) driver's
device attach), (2) `phy->id` == IGP03E1000/IGP04E1000 (case at 286-295),
(3) an MDIO read failure at exactly that call. The audit guest's PCI bus
carries only virtio-net/blk and a bochs VGA (`env.txt`); igb never attaches,
so `phy->ops.set_d0_lplu_state` is never reachable. One attempt: verified
device absence + full source trace. Status `not_reproduced`, `impact none`
(observed); theoretical impact = transient link failure on real hardware
(availability of one link, recoverable) → severity Low, confidence certain.

## Checked and killed nearby (negative results with weight)

- 254-279: M88E1112/1512/1543 init reads all check `ret_val` before use.
- 1243-1283 (`e1000_check_for_link_media_swap`): every read/write checked;
  the ignored return of `e1000_check_for_link_82575` at 1277/1279 only
  affects a debug state, harmless.
- `e1000_set_eee_i354` (3073-3145) / `e1000_get_eee_status_i354`
  (3155-3180): all xmdio reads checked; `*status` in get_eee_status is
  left untouched on early-out (callers initialize), no stale-writeback.
- The I2C bit-bang helpers (3430-3777) return status per-step and are all
  checked by their callers (3291-3345).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.