{
  "finding_id": "DF-4084",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "sis_stop uses callout_stop (if_sis.c:2033), which per kern_timeout.c:1087 does not interlock against a callout that is in-progress, while sis_tick unconditionally re-arms itself with callout_reset as its last serialized action (if_sis.c:1498). A tick blocked on if_serializer during sis_stop completes afterwards and resurrects the timer; in the detach path (if_sis.c:1196-1224) that late tick dereferences the freed ifnet serializer, deleted miibus child, and released bus resources \u2014 use-after-free panic. Mechanism is source-certain (stop-vs-rearm contract), trigger is privileged (detach/kldunload) plus timing. Untested: QEMU has no SiS NIC.",
  "exploit_chain": "",
  "evidence": "README.md, VERDICT.md. Key lines: if_sis.c:1123 (callout_init), 1484/1498 (tick serialize + re-arm), 2033 (callout_stop), 1196-1224 (detach frees), kern_timeout.c:1087-1088 (non-interlocking stop), oce_if.c:331 (correct callout_terminate pattern).",
  "kernel_refs": [
    "sys/dev/netif/sis/if_sis.c:1123",
    "sys/dev/netif/sis/if_sis.c:1484",
    "sys/dev/netif/sis/if_sis.c:1498",
    "sys/dev/netif/sis/if_sis.c:2033",
    "sys/dev/netif/sis/if_sis.c:1206",
    "sys/kern/kern_timeout.c:1087"
  ],
  "poc_changes": "No runnable PoC: hardware-gated (sis_tick requires the SiS/DP83815 PHY). Mechanism documented at source level.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "DF-3715 family (callout discipline, em was AB-BA deadlock; sis flavor is resurrect-after-stop -> post-detach UAF). Privileged trigger; also leaves a stray 1 Hz tick on a stopped interface after plain ifconfig down. Fix is one word: callout_terminate.",
  "recommended_fix": "Replace callout_stop(&sc->sis_timer) with callout_terminate(&sc->sis_timer) in sis_stop.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not possible: no SiS hardware/emulation in QEMU.",
  "fix_evidence": "Guest pciconf -l: no vendor 0x1039/0x100b devices."
}