{
  "finding_id": "DF-4695",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Mechanically certain from source, no runtime needed: sili_pm.c:495 sets error=EBUSY on unexpected device-signature change (author-intended, marked /* XXX */), and sili_pm.c:498 unconditionally overwrites it with error=0, so the EBUSY can never reach the caller; at->at_probe then advances to NEED_IDENT (:515) with stale at_type after a device swap behind the PM. ahci twin: ahci_pm.c:853-856 (same dead store). Runtime manifestation requires PM hardware absent from the audit guest (env.txt); the trigger documents the gate.",
  "exploit_chain": "",
  "evidence": "VERDICT.md Proof quotes sili_pm.c:489-499 verbatim showing the dead store; fix.diff also carries the ahci_pm.c twin.",
  "kernel_refs": [
    "sys/dev/disk/sili/sili_pm.c:489-498",
    "sys/dev/disk/sili/sili_pm.c:515",
    "sys/dev/disk/sili/sili_cam.c:904-915",
    "sys/dev/disk/ahci/ahci_pm.c:849-856"
  ],
  "poc_changes": "No seed; trigger kept only to document the hardware gate.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o trigger_sili_pm trigger_sili_pm.c",
  "run_cmd": "./trigger_sili_pm 15",
  "code_hash": "d828da682541b4da49c76cad80f4c6c846db506937fe2ce219ce1d9a38d4591e",
  "notes": "Low: probe-logic degradation (wrong IDENTIFY variant, self-heals via probe failure); no memory-safety impact.",
  "recommended_fix": "Only clear error when not EBUSY (sili_pm.c and ahci_pm.c twins).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not testable: the guest has no SiI 3124/3132 HBA and QEMU does not emulate the SiL3726 port multiplier, so neither baseline nor patched kernel can reach sili_pm_* at runtime. fix.diff is a line-accurate source-level fix (all referenced helpers declared in sili.h); code-reviewed only.",
  "fix_evidence": "env.txt (PCI inventory, 0 sili dmesg lines); fix.diff"
}