{
  "finding_id": "DF-4114",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, hardware-gated. In TBI mode nge_attach sets sc->nge_miibus = dev (self-reference, sys/dev/netif/nge/if_nge.c:864); nge_detach then calls device_delete_child(dev, dev) (if_nge.c:941-942). Path A (normal detach via kldunload/devctl): the nested device_delete_child -> device_detach(dev) sees state still DS_ATTACHED (set to DS_NOTPRESENT only at subr_bus.c:2149, after DEVICE_DETACH returns) and re-enters nge_detach recursively - unbounded recursion re-running teardown each level (double bus_teardown_intr, double ether_ifdetach, double contigfree of nge_ldata and the jumbo arena, if_nge.c:949-954) -> guaranteed panic (list corruption/double-free or stack exhaustion). Path B (attach-fail: nge_attach goto fail calls nge_detach directly at if_nge.c:921, e.g. bus_setup_intr failure at :913-916 after the TBI branch): the nested device_detach returns 0 for DS_ATTACHING (subr_bus.c:2136-2137), the empty-grandchild loop is skipped, and TAILQ_REMOVE(&dev->children, dev, link) (subr_bus.c:1304) silently unlinks the live device from its PARENT PCI bus children list mid-attach, then kobj_delete((kobj_t)dev) (subr_bus.c:1306) frees the live device_t - use-after-free in newbus for the remainder of device_attach. Requires a TBI-mode DP83820 board plus root (or boot-time IRQ alloc failure) -> Low severity, privileged DoS + newbus corruption. Guest has no DP83820 (presence_probe.sh: NGE_ABSENT): honestly untested; not a false positive - every step is unconditional in the source.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4114/VERDICT.md (trace if_nge.c:860-864/913-922/941-942/949-954, subr_bus.c:1284-1310/2129-2153); presence_probe.sh + env.txt; fix.diff (self-child guard)",
  "kernel_refs": [
    "sys/dev/netif/nge/if_nge.c:864",
    "sys/dev/netif/nge/if_nge.c:921",
    "sys/dev/netif/nge/if_nge.c:941",
    "sys/dev/netif/nge/if_nge.c:949",
    "sys/kern/subr_bus.c:1292",
    "sys/kern/subr_bus.c:1304",
    "sys/kern/subr_bus.c:1306",
    "sys/kern/subr_bus.c:2136"
  ],
  "poc_changes": "No seed PoC. Hardware-gated (no DP83820/TBI board on guest); presence probe only.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "(none - hardware-gated; presence_probe.sh only)",
  "run_cmd": "vm.sh run_root ifconfig -l; pciconf -l | grep 0x0022100b  # -> NGE_ABSENT",
  "code_hash": "SKIP-HW-GATED-4114",
  "notes": "DFly-specific: the TBI support branch (sc->nge_miibus = dev) is a DragonFly addition; FreeBSDs if_nge has no TBI self-reference. Non-TBI nge boards are unaffected (real miibus child is deleted normally).",
  "recommended_fix": "Guard the detach self-reference: if (sc->nge_miibus && sc->nge_miibus != dev) device_delete_child(dev, sc->nge_miibus);",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (patch --dry-run clean); cannot be validated without a TBI-mode DP83820 board.",
  "fix_evidence": "findings/poc/DF-4114/fix.diff"
}