{
  "finding_id": "DF-4653",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "puc_setup_intr() (sys/dev/misc/puc/puc.c:691-692) publishes the child interrupt handler BEFORE its argument, while puc_intr() (puc.c:407-409) gates dispatch on ihand != NULL alone. puc_pci_attach registers puc_intr on an RF_SHAREABLE line before any child exists (puc.c:229-238, serializer NULL), children register during device_probe_and_attach (:351) via sio_attachs bus_setup_intr(INTR_MPSAFE, siointr, com) (sio.c:1236), and the handlers are unsynchronized \u2014 so a shared-IRQ event dispatched on another CPU between the two stores calls siointr with the still-NULL ihandarg (softc bzerod at puc.c:214), which immediately dereferences it (sio.c:1750-1755 -> siointr1, first deref :1797+) = kernel NULL-deref panic during boot. Plain barrier-less stores mean the compiler may also widen the window; the teardown side (:711-712) has correct order but is dead code (no in-tree child driver implements detach). The kernel manifestation is hardware-gated on the audit guest (no comm-class PCI device \u2014 run.log), so not_reproduced at kernel level; however the publication-order defect itself was PROVEN on the DragonFly guest by an interleaving model of the exact kernel store/load pattern: kernel order at faithful 2-store width dispatched the handler with NULL argument 2/140263 times, widened 36901/49191, and the FIXED order (argument first, gate last) ZERO under the same widening (run.log phases A/B/C). Ceiling: boot-time DoS panic on machines with a puc-supported multiport serial card; no privilege gain.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (store-order trace + reachability chain + dead-teardown note); trigger.c + run.log (guest-executed model: A=2/140263 NULL-arg dispatches faithful-width, B=36901/49191 widened, C=0 fixed-order \u2014 order is the defect); build.log (guest cc -Wall -Wextra -pthread clean); env.txt/run.log probe (no comm-class PCI device on guest); fix.diff (publish ihandarg first + cpu_ccfence + inverse teardown order + defensive NULL-arg gate in puc_intr; git apply --check clean)",
  "kernel_refs": [
    "sys/dev/misc/puc/puc.c:229",
    "sys/dev/misc/puc/puc.c:236",
    "sys/dev/misc/puc/puc.c:407",
    "sys/dev/misc/puc/puc.c:409",
    "sys/dev/misc/puc/puc.c:691",
    "sys/dev/misc/puc/puc.c:692",
    "sys/dev/misc/puc/puc.c:711",
    "sys/dev/serial/sio/sio.c:1236",
    "sys/dev/serial/sio/sio.c:1750"
  ],
  "poc_changes": "No seed pack existed; trigger authored as a 3-phase pthread interleaving model (faithful / widened kernel order / widened fixed order) of the exact kernel store/load pattern, built and executed on the DragonFly guest.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 34,
  "guest_dirty": 0,
  "build_cmd": "guest: cc -Wall -Wextra -O2 -pthread -o df4653_trigger df4653_trigger.c (see build.sh)",
  "run_cmd": "./run.sh",
  "code_hash": "28958a4f42a46c69431d9b17dd1eaef3d6aa71af1316b8659954913f473937c1",
  "notes": "Kernel panic path hardware-gated (needs a pucdata.c-matched multiport serial card + shared-IRQ sibling event in a 2-store window during sio_attach; guest has none). The userspace model ran ON the guest and demonstrates the ordering defect deterministically (fixed order = 0 hits). Guest left clean (only /tmp scratch files). Distinct from DF-1791/1792/1793 (different defects: NULL BAR deref, dangling ivars, IRQ leak).",
  "recommended_fix": "Publish ihandarg before ihand with cpu_ccfence() between (and inverse order in teardown); see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not validated at kernel runtime on guest: baseline cannot run (no puc card). fix.diff applies cleanly (git apply --check) against puc.c; the models phase C demonstrates the fixed ordering yields zero NULL-argument dispatches under the same widening that produces 36901 with the kernel order.",
  "fix_evidence": "findings/poc/DF-4653/fix.diff"
}