{
  "finding_id": "DF-4305",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain sleepable-allocation defect: the bfe_intr error path (sys/dev/netif/bfe/if_bfe.c:1176-1187) calls bfe_init at :1186 from interrupt context; bfe_init -> bfe_list_rx_init (:1368) -> bfe_newbuf(sc, i, 1) -> m_getcl(M_WAITOK) at :565 allocates 511 clusters sleepably inside the ithread while it holds the interface serializer, and the load-failure branch calls if_printf (:576). BFE_ISTAT_RDU (receive descriptor underflow, if_bfereg.h:32) - the most likely error to fire - occurs exactly under cluster exhaustion, making the M_WAITOK re-arm sleep in the interrupt thread precisely when the system cannot satisfy it: the NICs IRQ line and every serializer-guarded entry point stall until (unless) clusters free up elsewhere. The TX-watchdog reinit (bfe_watchdog :1470-1483 -> bfe_init :1480, netisr context) is equally non-sleepable and hits the same path. Kernel-path reproduction is impossible on this guest: no Broadcom BCM4401/4402 device exists and QEMU provides no model (env.txt: NO_BROADCOM_PCI, hw.bfe unknown oid); verdict not_reproduced with the defect certain from the source trace, per family convention (DF-3827). Impact ceiling: interface/interrupt-line stall (soft deadlock) under memory pressure - availability only, no memory corruption.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (path:line trace incl. the RDU self-reinforcement argument and the netisr watchdog sibling); env.txt (no Broadcom PCI, hw.bfe unknown oid, guest src md5 == audited tree); fix.diff (waitok plumbing, patch -p1 --dry-run clean)",
  "kernel_refs": [
    "sys/dev/netif/bfe/if_bfe.c:1186",
    "sys/dev/netif/bfe/if_bfe.c:1368",
    "sys/dev/netif/bfe/if_bfe.c:565",
    "sys/dev/netif/bfe/if_bfe.c:576",
    "sys/dev/netif/bfe/if_bfe.c:1480",
    "sys/dev/netif/bfe/if_bfereg.h:32"
  ],
  "poc_changes": "No seed; no runnable PoC exists without BCM4401 hardware - pack documents the source proof, the trigger analysis, and the fix.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "(none - hardware-gated path)",
  "run_cmd": "vm.sh run_root pciconf -l | grep -i -E \"14e4|broadcom\" || echo NO_BROADCOM_PCI; sysctl hw.bfe",
  "code_hash": "",
  "notes": "Low severity per rubric (narrow trigger: error interrupt under memory exhaustion). Checklist item for pass-2 depth beyond the DF-3715/DF-3761 families; FreeBSDs if_bfe shares the shape (upstream-inherited), fix is DFly-side.",
  "recommended_fix": "Plumb a waitok flag through bfe_init/bfe_list_rx_init/bfe_newbuf and pass 0 (M_NOWAIT) from the interrupt (bfe_intr :1186) and watchdog (:1480) reinit paths; see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (patch -p1 --dry-run clean); cannot be runtime-validated without BCM4401 hardware.",
  "fix_evidence": "findings/poc/DF-4305/fix.diff"
}