# DF-4259 VERDICT — my_stop frees buffers with DMA engines not proven idle

## Status: inconclusive on the audit guest (hardware-gated). Missing quiesce certain; race outcome hardware-timing dependent.

## Reproduction attempt

Guest has no Myson device (env.txt): no `my0`, no DMA. A software-only
reproduction is impossible because the hazard is the NIC's DMA engine
writing into buffers after the driver has released them.

## Analysis

`my_stop` (if_my.c:1643-1680) clears RE|TE, unmasks nothing, and within a
few instructions frees all 64 RX clusters and all queued TX mbufs and
bzeros both descriptor rings. It never polls `MY_TXRUN`/`MY_RXRUN`
(if_myreg.h:58, 82) — the exact idle-wait the same driver performs in
`my_setcfg` (if_my.c:705-717) before merely *changing duplex bits*. The
asynchronous engine rundown window is therefore unbounded from the
driver's perspective: an RX descriptor already fetched by the engine keeps
its `my_data` physical address (latched before the bzero) and the NIC can
complete the DMA into the freed cluster after `m_freem` returns it to the
zone. Reuse of that cluster by any kernel consumer turns the trailing DMA
into a write of packet-controlled bytes into live kernel memory.

Reachability: every interface re-init path — `ifconfig my0 down|up`
(SIOCSIFFLAGS), media change (my_init from my_autoneg_mii tail,
if_my.c:537), watchdog reset (if_my.c:1631-1633), detach, shutdown. Root
ioctl + traffic race on real hardware.

Severity Low (hardware-gated, timing window, root-coordinated trigger),
CWE-362/CWE-416, confidence likely.

## Fix

Wait for TXRUN|RXRUN to clear (my_setcfg-style bounded poll, optionally a
chip reset) before freeing the buffers — fix.diff.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.