# DF-3927 VERDICT

**status: not_reproduced (hardware-gated)** | **impact observed: none** | **source certainty: likely**

The shift `1 << tmp` at siba_core.c:2131-2132 uses a value masked to 6 bits
(SIBA_TPS_BPFLAG=0x3f, sibareg.h:259) read from device MMIO (SIBA_TPS).
tmp in [32,63] is undefined behavior; on x86 it silently enables
bit (tmp & 31) of SIBA_INTR_MASK — wrong interrupt source on the shared PCI
IRQ. Only reachable on cards exposing a PCI (not PCIE) core with sd_rev < 6
plus ChipCommon rev < 6 — pre-2004 silicon. The audit guest has no Broadcom
SSB card (env.txt), so no runtime observation; filed as Info hardening /
correctness. Upstream (FreeBSD siba) has the identical expression.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.