# DF-4230 — VERDICT

**Status: untested** (kernel-side run requires the trackpad hardware; the
uninitialized-read mechanism and its control over the reset decision are
demonstrated deterministically by the exact-branch harness on the guest).

## Root cause (line-accurate)
```c
struct cyapa_regs regs;                          /* cyapa.c:1164 uninit */
...
error = smbus_request_bus(bus, sc->dev, SMB_WAIT);
if (error == 0) {
        error = smbus_trans(..., (void *)&regs, sizeof(regs), NULL);
        if (error == 0)
                isidle = cyapa_raw_input(sc, &regs);   /* only success writes regs */
}
if (cyapa_reset ||
    ((regs.stat & CYAPA_STAT_RUNNING) == 0 &&          /* cyapa.c:1192 UNINIT READ */
     (unsigned)(ticks - last_reset) > TIME_TO_RESET)) {
        cyapa_reset = 0;
        last_reset = ticks;
        init_device(sc->dev, NULL, sc->addr, 2);       /* cyapa.c:1196 */
}
```
`regs` is only written on a *successful* transfer. When the device is
absent/glitching (first iteration fails), `regs.stat` is uninitialized
stack; after 3 s of failures the garbage bit-7 (CYAPA_STAT_RUNNING)
decides whether `init_device()` bootloader handshakes are re-issued every
3 s. (`isidle` at cyapa.c:1168 also goes stale on failure — same family.)

## Harness result (audit guest, cc 8.3, -O0)
```
poison 0x2d (RUNNING clear): after 31 failing iterations: reinited=1  <- from garbage
poison 0xcd (RUNNING set)  : after 40 failing iterations: reinited=0  <- from garbage
```
Both outcomes of the decision flip purely on the uninitialized byte
(2/2 runs each) — the driver's bus-recovery behavior is controlled by
stale stack data.

## Why only Info
- The value never leaves the kernel (no printf of regs on the failure
  path — cyapa_raw_input, which prints, only runs on success).
- No memory-safety consequence; the worst case is unnecessary SMBus
  bootloader traffic while the device is dead.

## Recommended fix
Initialize `regs` before the poll loop (fix.diff):
`bzero(&regs, sizeof(regs));` — then `stat=0` ⇒ RUNNING clear ⇒ the
existing 3-second backoff governs re-init deterministically.

## Fix validation
Hardware-gated (poll thread unreachable in QEMU). fix_status =
not_testable; the fix is a one-line initialization.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.