# VERDICT — DF-3834

**status: inconclusive (source-certain, hardware-gated)** — reproduced: 0 — guest impact: none.

## Proof chain
1. `bwn_phy_lp_init` → `bwn_phy_lp_bbinit` (if_bwn_phy_lp.c:440, 643-652) → `bwn_phy_lp_tblinit`
   (647) → for `rev >= 2` calls `bwn_phy_lp_tblinit_r2` (1269).
2. `bwn_phy_lp_tblinit_r2` line 2742: `KASSERT(mac->mac_phy.rev < 2, ...)` — for every caller,
   `rev >= 2` holds, so on any kernel with INVARIANTS the assert fails **unconditionally** the
   first time an LP rev≥2 PHY is initialized (device attach/ifconfig up, and again from
   `bwn_phy_lp_bugfix`:1174).
3. `KASSERT` is only active with INVARIANTS (sys/sys/systm.h:94-96; no-op at 117). DragonFly's
   stock X86_64_GENERIC does not build with INVARIANTS, so production kernels never execute the
   assert — hence Low severity, but any debug/invariants kernel with the (GENERIC-included,
   sys/config/X86_64_GENERIC:268) bwn driver panics deterministically at first PHY init on this
   hardware class.
4. Upstream comparison: FreeBSD head sys/dev/bwn/if_bwn_phy_lp.c `bwn_phy_lp_tblinit_r2`
   contains the identical `KASSERT(mac->mac_phy.rev < 2, ...)` (verified against
   raw.githubusercontent.com/freebsd/freebsd-src/main, function starting at their line 2624) —
   the inversion is inherited from FreeBSD, and FreeBSD's own
   `bwn_phy_lp_gaintbl_write_r2` (their line 3730) shows the intended polarity `rev >= 2`,
   matching DragonFly's correct usage at if_bwn_phy_lp.c:3661.

## Guest
`bwn` is compiled into the guest kernel (kldstat -v: `62 siba_bwn/bwn`) but there is no
Broadcom PCI device (env.txt) — `bwn_attach` never runs, the path cannot be exercised.
Guest kernel is stock GENERIC (no INVARIANTS) so even with hardware the assert would be inert
there; the panic requires an INVARIANTS build.

## Fix
One-token fix: `< 2` → `>= 2` (fix.diff; git apply --check passes).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.