# DF-4543 VERDICT — not_reproduced (attack surface absent on guest; code mechanics verified by trace)

## Bottom line

The defect is real in the code (verified line-by-line below), but it is **not
reproducible on the audit guest**: the guest has no AGP-capable hardware, so
`agp_generic_attach` (sys/dev/agp/agp.c:240) never executes, `/dev/agpgart`
does not exist, and no detach lifecycle can even begin. Beyond the hardware
gate, the trigger is root-only (0600 root:wheel node) and requires either a
module-built agp kernel (`kldunload`) or PCI/ACPI hot-removal — the stock
X86_64_GENERIC kernel compiles agp in (sys/config/X86_64_GENERIC:170).

## Liveness evidence (run.log, fresh run)

```
ls: /dev/agpgart: No such file or directory          (ls_rc=1)
kldstat | grep -i agp                                 (empty, rc=1)
vgapci0@pci0:0:2:0: class=0x030000 chip=0x11111234    (QEMU/bochs virtual VGA, vendor 0x1234)
pciconf -lc | grep -i agp                             (empty, rc=1 — no AGP capability on any device)
PCI device count: 7
```

No AGP bridge ⇒ no chipset driver probe/attach ⇒ no make_dev ⇒ no userland
device ⇒ no lifecycle to race. Same probe rules out the AMD DCE audio path
(no AMD display device: the only class-0x03 device is the bochs VGA).

## Code trace (why the bug is real on suitable hardware)

1. `agp_generic_attach` — sys/dev/agp/agp.c:240-242:
   `sc->as_devnode = make_dev(&agp_ops, 0, UID_ROOT, GID_WHEEL, 0600, "agpgart");`
   `sc->as_devnode->si_drv1 = dev;`
   Minor is hardcoded **0** and the name **"agpgart"** for *every* agp unit.

2. `agp_free_cdev` — sys/dev/agp/agp.c:248-251:
   `dev_ops_remove_minor(&agp_ops, device_get_unit(dev));`
   `dev_ops_remove_minor` (sys/kern/kern_device.c) forwards to
   `devfs_destroy_dev_by_ops(ops, minor)` which matches cdevs by si_ops+minor.
   The created cdev has minor 0; the removal uses the *unit*.
   - unit 0: matches (correct removal), but only unlinks + release_dev
     (sys/vfs/devfs/devfs_core.c:1440-1463); an open fd's vnode keeps the
     cdev (and `si_drv1`) alive past softc free → UAF on that fd.
   - unit != 0: matches nothing → **node never removed**; after detach+softc
     free, the surviving `/dev/agpgart` has a dangling `si_drv1` and any
     later `open` by root enters `agp_open` (agp.c:777-779) on freed memory.

3. Consumer derefs of the dangling pointer: `agp_open` agp.c:777-779,
   `agp_close` agp.c:792-794, `agp_ioctl` agp.c:818-820, `agp_mmap`
   agp.c:857-858 — all do `device_get_softc(kdev->si_drv1)`.

4. No chip-driver detach checks for an open client:
   agp_via.c:226, agp_sis.c:172, agp_amd64.c:251, intel-gtt.c:914 all call
   `agp_free_cdev(dev)` blindly and proceed to free the GATT/resources.

## Why not the known findings

DF-1685/2397 are races *between ioctls* on an attached device; DF-1686/2400
is the mmap off-by-one; DF-1687/2399 is the every-close wipe; DF-1688 the
signed unbind loop; DF-2398 the bind bounds-check wrap. None of them covers
attach/detach device lifecycle or the free_cdev unit-vs-minor mismatch.

## Exploit chain

None developed — hardware gate. On suitable hardware the primitive would be:
root opens /dev/agpgart, keeps fd; root unloads agp.ko (module kernel);
ioctl on the fd hits freed softc → UAF write via `as_state`/TAILQ fields.
Purely privileged; escalation value ~none (already root). It is a
correctness/robustness UAF worth fixing.

## Fix validation

`fix.diff` authored (agppriv.h + agp.c + 4 chip drivers): refuse
`agp_free_cdev` while `sc->as_isopen`, propagate EBUSY from all detaches,
and `destroy_dev(sc->as_devnode)` instead of the minor guess. **Not
testable** on this guest: no AGP hardware to attach, and agp is compiled
into the guest kernel so no module unload exists to drive the lifecycle.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.