# DF-4343 VERDICT

**Status: inconclusive on this guest (defect is static/plain-code)**
**reproduced: 0 · impact on this guest: none · confidence: certain**

All five defects are verifiable by direct source reading and greps; nothing
depends on runtime hardware behavior:

- `res` locals at `if_mn.c:1302` / `:1311` are never stored in `struct softc`
  (fields `m0v/m0p/m1v/m1p` hold only virtual/physical values,
  `if_mn.c:1307-1308`, `:1316-1317`); `grep -n bus_release_resource
  sys/dev/netif/mn/if_mn.c` → no matches (resources unreleasable by
  construction).
- Early returns at `:1314`, `:1326`, `:1334` discard previously allocated
  resources.
- `:1353-1355` `if (!u) return (0);` — mn_reset failure reported as attach
  success.
- `:1386-1389` `ng_make_node_common` failure → `return (0)`.
- `:1392-1396` name failure: `ng_rmnode` + `ng_unref` free the node (refs 1→0
  via the no-op `ngmn_shutdown` at `if_mn.c:280-285`, which never calls
  `ng_cutlinks`), leaving `sc->node` dangling in the still-live softc, then
  `return (0)`.
- `:1402-1411` device_methods contains no `device_detach`.

Guest verification attempt (see run.log): no 0x110a PCI device, driver not
built (`optional mn netgraph`), `kldload if_mn` ENOENT — attach paths cannot
be exercised at runtime on this guest; classification inconclusive for the
reproduction while the defect itself is certain from source.

Fix: `fix.diff` (git apply --check clean): retain both BAR handles in the
softc (`mem0`, `mem1`), release them + the IRQ on every error path, return
ENXIO on mn_reset / ng_make_node_common / ng_name_node failures, NULL the
node pointer after destroying it. A full `device_detach` is additionally
recommended upstream but is intentionally out of the minimal patch.

## Files

README.md, VERDICT.md, run.sh, run.log, env_guest.txt, fix.diff,
verdict.json, manifest.json (no runtime trigger exists for this class;
source-level citations are the demonstration).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.