{
  "finding_id": "DF-4259",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "my_stop (sys/dev/netif/my/if_my.c:1643-1680) clears MY_RE|MY_TE, zeroes the list-base registers, then immediately frees all 64 RX clusters and all queued TX mbufs and bzeros both descriptor rings \u2014 with no wait for MY_TXRUN/MY_RXRUN to clear and no chip reset. The drivers own my_setcfg (705-717) demonstrates the required idle-wait discipline (per the quoted Myson manual note) before even touching duplex bits, so the engine rundown is known asynchronous; a descriptor already fetched by the engine retains its latched my_data physical address across the bzero and can complete its DMA into a freed cluster after m_freem returns it, which becomes packet-controlled kernel heap corruption when the cluster is reused. Exposed on every stop path: my_init via SIOCSIFFLAGS/media change (1417), watchdog (1631), detach (979), shutdown (1692). Not executable on the audit guest (no Myson NIC, env.txt); the missing quiesce is certain at source level, the race outcome is hardware-timing dependent.",
  "exploit_chain": "On affected hardware: root races ifconfig down against flood traffic -> NIC DMA writes ethernet-controlled bytes into a reused mbuf cluster (socket buffer / pipe / arbitrary kernel object) -> controlled heap corruption; timing window is one descriptor per stop event.",
  "evidence": "VERDICT.md (stop path vs my_setcfg discipline contrast); env.txt",
  "kernel_refs": [
    "sys/dev/netif/my/if_my.c:1643-1680",
    "sys/dev/netif/my/if_my.c:705-717",
    "sys/dev/netif/my/if_my.c:1417",
    "sys/dev/netif/my/if_my.c:1631-1633"
  ],
  "poc_changes": "trigger.sh runs the down/up + flood race for affected hardware",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "./trigger.sh (requires my0 + traffic)",
  "notes": "Same stop-discipline class as the DF-3604/3761/3715 NIC family; my(4) instance.",
  "recommended_fix": "Poll TXRUN|RXRUN idle (my_setcfg-style bounded loop) before freeing any buffers in my_stop",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the bounded idle-wait before the frees; hardware-gated, not validated here",
  "fix_evidence": "findings/poc/DF-4259/fix.diff"
}