{
  "finding_id": "DF-4230",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain uninitialized stack read: regs (cyapa.c:1164) is only written on smbus success, but the reset decision at cyapa.c:1191-1193 reads regs.stat on failure paths too; harness shows the re-init decision flipping solely on the uninitialized byte (2/2 per branch on the guest). Kernel-side run is hardware-gated (poll thread absent in QEMU). Info severity: no leak (value never printed), no memory unsafety - only nondeterministic bus-recovery behavior while the device is dead.",
  "exploit_chain": "",
  "evidence": "run.log + build.log (0x2d -> reinited, 0xcd -> not reinited, both from garbage byte), VERDICT.md, fix.diff",
  "kernel_refs": [
    "sys/dev/smbus/cyapa/cyapa.c:1164",
    "sys/dev/smbus/cyapa/cyapa.c:1191",
    "sys/dev/smbus/cyapa/cyapa.c:1196"
  ],
  "poc_changes": "n/a - pack authored fresh",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cc -O0 -Wall -o model_uninit_regs model_uninit_regs.c",
  "run_cmd": "./model_uninit_regs 0x2d ; ./model_uninit_regs 0xcd",
  "code_hash": "184b280efc12796b7417a94850191cbb2aef5a1c14e223599e1a127cdcbe35e2",
  "notes": "Info/hardening finding; harness demonstrates mechanism deterministically.",
  "recommended_fix": "bzero(&regs, sizeof(regs)) before the poll loop (fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Hardware-gated validation; one-line initialization against the traced path, applies cleanly to sys/.",
  "fix_evidence": "findings/poc/DF-4230/fix.diff (git apply --check clean)"
}