# DF-4084 VERDICT — sis_stop callout resurrection / post-detach UAF

## Status: UNTESTED (hardware-gated; mechanism source-certain)

No SiS/DP83815 device exists in the QEMU guest (pciconf: no 0x1039/0x100b),
so sis_tick cannot be made to fire; the race cannot be staged end-to-end on
the available system.

## Why the mechanism is certain from source

1. sys/kern/kern_timeout.c:1080-1094: callout_stop is explicitly documented
   "does not interlock against a callout that is in-progress" — it cannot
   stop a callback that has already fired and is blocked on the serializer.
2. if_sis.c:1484/1498-1499: sis_tick takes if_serializer, then re-arms with
   callout_reset as its last action before releasing it.
3. if_sis.c:2033: sis_stop only does callout_stop. Every sis_stop caller
   (sis_ioctl:1974-1980, sis_watchdog:2013, sis_init:1769, sis_detach:1206)
   holds if_serializer — exactly the lock the in-flight tick is waiting on,
   guaranteeing the resurrection window whenever stop races a firing tick.
4. sis_detach (1196-1224) then frees the miibus child (1213), the IRQ and
   register resources (1216-1219) and DMA state (1221) — a late/resurrected
   tick dereferences all of them (1484-1495) → UAF.
5. The sibling driver oce uses callout_terminate for exactly this reason
   (sys/dev/netif/oce/oce_if.c:331); sis predates the discipline (callout
   code even carries a DF-3715-era comment about lock-aided callouts at
   kern_timeout.c:1080-1082).

Trigger: privileged (devctl detach / kldunload if_sis / reboot-time
sis_shutdown) racing the 1 Hz tick. Probability per attempt is small
(microseconds-scale window per second) but the action repeats across
up/down cycles (ifconfig down leaves the timer alive too, enlarging later
windows).

## Fix

	callout_terminate(&sc->sis_timer);  in sis_stop (replaces callout_stop)

— synchronous cancel; no resurrection; safe because sis_stop runs under the
same serializer the tick needs, so no callback can be executing when it
returns.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)