# DF-3905 — sk_marv_miibus_writereg(): inverted BUSY check aborts the SMI
# write-completion wait the moment the write *starts*

**File:** `sys/dev/netif/sk/if_sk.c` (pass 2, GLM 5.3)
**Hardware-gated:** Yukon (SK_YUKON*) PHY writes only happen on real
Marvell/SysKonnect hardware; the audit guest has none. Source-certain via
comparison with the sibling driver and FreeBSD/OpenBSD lineage.

## The bug (source)

`sk_marv_miibus_writereg()` (`sys/dev/netif/sk/if_sk.c:507-529`) issues an
SMI (MII management) write and then tries to wait for completion:

```c
SK_YU_WRITE_2(sc_if, YUKON_SMICR, ... | YU_SMICR_OP_WRITE);   /* :515-517 */

for (i = 0; i < SK_TIMEOUT; i++) {                            /* :519    */
        DELAY(1);
        if (SK_YU_READ_2(sc_if, YUKON_SMICR) & YU_SMICR_BUSY) /* :521-522 */
                break;                                        /* WRONG   */
}
```

The condition is inverted: it breaks the wait **as soon as BUSY is set** —
i.e. exactly when the write has *started* — and otherwise burns the full
1000×DELAY(1) loop when the PHY is idle. The correct protocol (wait while
BUSY is set, proceed when it clears) is what the sibling driver implements
for the same hardware family:

- `msk_phy_writereg()` — `sys/dev/netif/msk/if_msk.c:417-428`:
  `if ((GMAC_READ_2(...GM_SMI_CTRL) & GM_SMI_CT_BUSY) == 0) break;`

So under if_sk.c the "wait for write completion" never waits for the
completion. Consequences on Yukon hardware: the caller (miibus layer,
`sk_init_yukon`, `mii_mediachg` from the 1 Hz tick / media ioctls) can
issue the next SMI operation while the previous PHY write is still in
flight; Marvell SMI executes one operation at a time, so back-to-back
writes can be silently dropped — PHY configuration (aneg restart, power
state, media override) intermittently not taking effect. This is a
functional-correctness bug (media/PHY state machine misconfiguration, link
flaps), not memory corruption.

## Lineage

The inverted form is a DFly-carried transcription bug (present since the
driver import); FreeBSD `if_sk.c` historically waits with
`(SMICR & BUSY) == 0`.

## Why not runtime-verified

No Yukon silicon on the audit guest (`YUKON_SMICR` MMIO unreachable);
the defect is a two-token logic inversion proven by source diff against
the in-tree sibling driver handling the same PHY. status `inconclusive`
per family convention for hardware-gated findings.

## Fix

`fix.diff`: invert the break condition to `(... & YU_SMICR_BUSY) == 0`,
matching `msk_phy_writereg()` exactly.