# DF-4328 — verdict: NOT REPRODUCED ON GUEST (source-level; hardware/driver-gated)

## Root cause (path:line)
- sys/dev/netif/sf/if_sf.c:777-780 — on bus_setup_intr() failure:
  `ether_ifdetach(ifp); device_printf(...); goto fail;`
- sys/dev/netif/sf/if_sf.c:786 — `fail: sf_detach(dev);`
- sys/dev/netif/sf/if_sf.c:796 — device_is_attached(dev) is still true
  (device detach flags unchanged), so sf_detach executes:
  - :802 `ether_ifdetach(ifp)` — SECOND time. ether_ifdetach -> if_detach
    (sys/net/if.c:949+) is not idempotent: second run re-announces
    IFAN_DEPARTURE/devctl, re-runs TAILQ_REMOVE(&ifnetlist,...),
    ifnet_array_del() on an array no longer containing ifp, double
    mcl_inclimit decrement, double ifgroup teardown -> list corruption
    or panic.
  - :799 `bus_teardown_intr(dev, sc->sf_irq, sc->sf_intrhand)` with
    sc->sf_intrhand == NULL (setup failed).

## Why not reproduced
Requires an sf(4) device whose interrupt setup fails at attach (IRQ
exhaustion); the guest has no AIC-6915 hardware, so neither the success
nor the failure path of sf_attach can execute. Reported at source-level
certainty (Low severity, root/admin trigger: kldload/boot-time only).

## Fix
fix.diff: drop the duplicate ether_ifdetach() from the attach error path
(sf_detach already performs it) and NULL-guard the teardown cookie.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.