{
  "finding_id": "DF-4497",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Defect confirmed at source level (stale xq/rq mbuf pointers walked by free_sent_buffers/indicate_frames after deactivate() frees them via drop_queues, because sbsh_intr handles EXT before TXS/RXS/UFL and no state guard exists); runtime reproduction impossible on the audit QEMU guest because the Granch SBNI12/16 PCI device (0x55:0x9d) is absent, so the driver never attaches. BPF trigger compiled and ran on the guest, failing only at BIOCSETIF (no sbsh0).",
  "exploit_chain": "peer carrier drop coincident with frame completion (or root ifconfig-down under load) -> deactivate() drop_queues frees mbufs -> same/deferred ISR TXS branch double-frees xq[] mbuf, RXS branch writes 11-bit device value into freed mbuf and feeds it to if_input -> mbuf freelist poisoning -> uid=0 (requires real hardware for the race window)",
  "evidence": "VERDICT.md (source proof chain); run.log (BIOCSETIF: Device not configured - interface cannot exist on guest); env.txt (pciconf: no 0x55:0x9d); fix.diff (state guards + SR drain + slot NULLing)",
  "kernel_refs": [
    "sys/dev/netif/sbsh/if_sbsh.c:571-604",
    "sys/dev/netif/sbsh/if_sbsh.c:849-860",
    "sys/dev/netif/sbsh/if_sbsh.c:811-823",
    "sys/dev/netif/sbsh/if_sbsh.c:726-748",
    "sys/dev/netif/sbsh/if_sbsh.c:789-809",
    "sys/dev/netif/sbsh/if_sbsh.c:491-496"
  ],
  "poc_changes": "added missing #include <net/if.h> for struct ifreq (seed would not compile); added device-absence early-exit in run.sh",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 95,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o /tmp/df4497_trigger /tmp/df4497_trigger.c",
  "run_cmd": "/tmp/df4497_trigger sbsh0",
  "code_hash": "f55e66eed63fd8eb4d2fa251131ef0883db7fc7ec2948fabc16853045bb21a4d",
  "notes": "fix fields below; status uses strict set - device absent maps to inconclusive (logic certain, execution impossible). Guest left clean (only /tmp artifacts).",
  "recommended_fix": "guard free_sent_buffers/indicate_frames/resume_tx on sc->state == ACTIVE; drain latched SR bits and resync head_tdesc/head_rdesc in deactivate(); NULL freed xq/rq slots in drop_queues()",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored post-verification against read-only sys/; baseline itself cannot run on this guest (no device), so patched-kernel validation was not possible",
  "fix_evidence": "fix.diff"
}