{
  "finding_id": "DF-3926",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "siba_cc_power_init dereferences scc->scc_dev->sd_bus with no NULL guard (siba_core.c:1042) while every sibling (siba_cc_clock :786, attach-path callers :210-215, siba_powerdown_sub :1900) guards it. siba_core_resume calls siba_cc_resume unconditionally (:2245 -> :2223), so a suspend/resume cycle on a card whose siba_scan found no ChipCommon core (early returns at :296/:325 — the latter keyed on the device-controlled SIBA_CC_NCORES value) panics with a NULL deref. Certain at source; not reproduced because the guest has no Broadcom SSB hardware.",
  "exploit_chain": "SSB card + failed/garbage core scan (device-controlled) -> bwn child never created but siba bus device attached -> ACPI S3 suspend/resume -> siba_core_resume -> siba_cc_power_init NULL-deref panic",
  "evidence": "VERDICT.md asymmetric-guard trace (:1042 unguarded vs :786/:210/:1900 guarded)",
  "kernel_refs": ["sys/dev/netif/bwn/siba/siba_core.c:1042", "sys/dev/netif/bwn/siba/siba_core.c:2245", "sys/dev/netif/bwn/siba/siba_core.c:325"],
  "poc_changes": "n/a (fresh pack)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "hardware: SSB card with failed scan + suspend/resume",
  "code_hash": "",
  "notes": "Distinct from DF-1939 (siba_bwn_read_ivar NULL-deref): this is the resume-path power_init deref. siba_cc_powerup_delay (:1071) has the same unguarded deref but all its callers are gated.",
  "recommended_fix": "Add the scc_dev NULL guard to siba_cc_power_init (and siba_cc_powerup_delay for symmetry)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the standard NULL guard; cannot validate without SSB hardware",
  "fix_evidence": "fix.diff in this pack; never applied to sys/"
}