{
  "finding_id": "DF-4572",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code-level defect is certain: exca_activate_resource (exca.c:779-802) claims an ExCA window via exca_io_map/exca_mem_map and then calls the parent bridges BUS_ACTIVATE_RESOURCE (exca.c:800) with no unwind on failure; exca_deactivate_resource (exca.c:808) is gated on RF_ACTIVE, which a failed activation never sets, so the window bit (5 MEM / 2 IO per socket) is leaked permanently and repeated failures exhaust the sockets windows (exca_io_map returns 1 at exca.c:474). Not runnable on the audit guest: QEMU exposes no CardBus/PCMCIA bridge (no PCI class 0607 device, devinfo has no pccard/cbb/exca, run.log), so impact could not be demonstrated at runtime. Impact ceiling: per-socket availability DoS of 16-bit PC Card resource mapping, hardware-gated (pccbb bridge + card insertion cycles), no kernel memory corruption.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (path:line trace + on-hardware trigger); run.log/env.txt (guest hardware absence: NO_CARDBUS_BRIDGE); fix.diff (releases window bits on both error paths)",
  "kernel_refs": [
    "sys/dev/pccard/exca/exca.c:779",
    "sys/dev/pccard/exca/exca.c:800",
    "sys/dev/pccard/exca/exca.c:804",
    "sys/dev/pccard/exca/exca.c:258",
    "sys/dev/pccard/exca/exca.c:474",
    "sys/dev/pccard/pccbb/pccbb.c:1286",
    "sys/dev/pccard/pccbb/pccbb_pci.c:332"
  ],
  "poc_changes": "n/a \u2014 no PoC build possible; only the environment check run.sh was executed on the guest",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "./run.sh",
  "code_hash": "",
  "notes": "Low-severity, hardware-gated finding: PoC skipped per contract for Low findings, and additionally impossible on this guest (no ExCA controller emulated). Status inconclusive chosen from the persist_poc vocabulary for hardware-unavailable. Same defect family at exca_mem_map exca.c:258-262 (memreg error return) is unreachable via the live pccbb_pci path (EXCA_HAS_MEMREG_WIN set unconditionally, pccbb_pci.c:332) but fixed in the same diff.",
  "recommended_fix": "Release the ExCA window bit when parent BUS_ACTIVATE_RESOURCE fails, and on exca_mem_maps memreg error return (fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validated by inspection only: fix.diff restores the window bit on both error paths (exca.c:258-262 and the parent-activate failure in exca_activate_resource) and cannot regress the success path; no pccbb hardware on the guest to build/run a single-fix kernel against.",
  "fix_evidence": "fix.diff in findings/poc/DF-4572/"
}