# VERDICT — DF-4546

## Reproduced: YES (lifted-copy harness, macro-faithful; in-kernel path hardware-gated)

- **Root cause proven** (lm78.c): `wb_match()` case `WB_CHIPID_W83791SD`
  (:590-592) sets a description but never calls `lm_setup_sensors()`, so
  `sc->numsensors == 0`; `lm_attach()` returns early at :427-429 **before**
  `sensordev_install()` (nothing is ever inserted into the global
  sensordev_list); `lm_detach()` (:450-451) unconditionally calls
  `sensordev_deinstall(&sc->sensordev)`.
- **Fault mechanics proven** (kern_sensors.c:154-160 → sys/sys/queue.h:646-662):
  TAILQ_REMOVE on the zeroed, never-inserted node: `tqe_next == NULL` →
  `sensordev_list.tqh_last = NULL` (global list corrupted), then
  `*(tqe_prev == NULL) = tqe_next` → immediate write to virtual address 0.
  In the kernel that is an unrecoverable NULL-page write → panic. The
  harness replicates the exact macro expansion (verbatim from queue.h) and
  struct layout (sensors.h:156-166) in a calloc'd softc.
- **Harness result** (run.log): CONTROL (numsensors=19) installs and
  detaches cleanly; BUG (numsensors=0, the W83791SD path) →
  **SIGSEGV: kernel-equivalent NULL-pointer WRITE at 0x0** inside
  sensordev_deinstall; PATCHED (fix.diff guard) → clean detach.
- **Trigger realism**: requires an lm(4) bound to a W83791SD and a
  privileged detach (kldunload / devctl). Root-triggered local DoS on rare
  hardware → severity Low. The defect is structural: any future match
  entry without a sensor table arms the same crash.

## Fix validation

- `git apply --check` OK
- Kernel-toolchain `-fsyntax-only` of patched lm78.c in the
  X86_64_GENERIC objdir: PATCHED_RC=0 (0 bytes diagnostics) with a
  deliberate-syntax-error negative control failing (NEGCTL_RC=1) —
  fix_build.log; guest /usr/src restored + verified
- Harness PATCHED control: zero-sensor attach detaches without a fault

## Kernel refs
sys/dev/powermng/lm/lm78.c:590,
sys/dev/powermng/lm/lm78.c:427,
sys/dev/powermng/lm/lm78.c:450,
sys/kern/kern_sensors.c:153,
sys/sys/queue.h:646,
sys/sys/sensors.h:156,
sys/dev/powermng/lm/lm78var.h:126

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.