{
  "finding_id": "DF-4354",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "sn_attach() (sys/dev/netif/sn/if_sn.c:164) discards the return value of sn_activate(); on any attach-time resource-allocation failure the driver proceeds with port_res=NULL, irq_res=NULL and BASE=0, writing the chip-id/MAC/CONFIG register writes into ISA DMA-controller ports 0x00-0x0F and then hitting ifq_set_cpuid(..., rman_get_cpuid(sc->irq_res)) at if_sn.c:216, a NULL double-deref (sys/sys/rman.h:157) that panics the kernel during device attach. Source-level certainty is high (the probe path checks the identical call at if_sn.c:1236-1237; the attach path does not), but the bug is hardware-gated: it requires an SMC91xx PCMCIA NIC, which the QEMU audit guest does not have (only vtnet0/lo0; if_sn is an optional module with a pccard-only front-end), so no runtime PoC is possible -> untested. Expected impact on real hardware is a boot/card-insert-time kernel panic plus stray low-port I/O; severity Low.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (root-cause chain with path:line), README.md (site table + fix), env.txt (guest lacks hardware: ifconfig -l shows vtnet0 lo0, no sn module loaded), fix.diff (one-line error propagation mirroring the probe path). Decisive lines: if_sn.c:164 (unchecked return), if_sn.c:216 (rman_get_cpuid(NULL)), sys/sys/rman.h:157 (((r)->r_rm->rm_cpuid)).",
  "kernel_refs": [
    "sys/dev/netif/sn/if_sn.c:164",
    "sys/dev/netif/sn/if_sn.c:216",
    "sys/dev/netif/sn/if_sn.c:173",
    "sys/dev/netif/sn/if_sn.c:188",
    "sys/dev/netif/sn/if_sn.c:1177",
    "sys/dev/netif/sn/if_sn.c:1188",
    "sys/sys/rman.h:157",
    "sys/dev/netif/sn/if_snreg.h:400"
  ],
  "poc_changes": "No executable PoC exists: path requires SMC91xx PCMCIA hardware absent from the guest. Evidence pack is source-level (VERDICT.md) plus guest hardware-inventory proof (env.txt).",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root:dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": "sha256:5f8b40f2ae2b562f6d085476c77bfa6c032d8be1be7eacf513cc6dcf3bf9a1c6 (fix.diff)",
  "notes": "Hardware-gated (pccard-only front-end, sys/dev/netif/sn/if_sn_pccard.c:106; module optional sn, sys/conf/files:1247). Guest inventory check performed and recorded in env.txt. Severity Low: local, config-race/resource-conflict triggered panic at attach, no memory corruption, no info leak. DF-1552 (chip_ids OOB print) becomes reachable with pure garbage input at attach through this same path - noted, not re-reported.",
  "recommended_fix": "Check the return value of sn_activate() in sn_attach() and propagate the error before any register access or rman_get_cpuid call.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: fix validation requires SMC91xx PCMCIA hardware (guest has none). The proposed fix.diff makes sn_attach() bail out immediately on sn_activate() failure, mirroring sn_probe() at if_sn.c:1236-1237; by inspection this removes both the rman_get_cpuid(NULL) deref and all BASE=0 port I/O on the failing path.",
  "fix_evidence": "findings/poc/DF-4354/fix.diff (1-hunk, error propagation); env.txt (hardware absent)."
}