{
  "finding_id": "DF-4730",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Pass-2 finding: apple_smc_sms_intr() (smc_io.c:620) unconditionally executes ASMC_INTPORT_READ(sc) = bus_read_1(sc->sc_ioport, 0x1f) (smc.h:113), but on MMIO-backend Macs sc->sc_ioport is NULL by construction (smc.c:178-186 allocates the IOPORT resource only when !sc_is_mmio). rman_get_bustag(NULL) is a raw ((r)->r_bustag) deref (sys/sys/rman.h:151) -> page-0 fault in interrupt context -> kernel panic. Armed on any MMIO SMC machine that also exposes the SMS key set (drivers own header documents MMIO-without-T2 hardware, e.g. iMac14,1, which is HDD-era = SMS population); trigger is an SMC event interrupt. Runtime verification impossible on the audit guest (no Apple SMC hardware; a faked ACPI APP0001 device cannot emulate SMC MMIO protocol). Static chain machine-checked by verify.sh/static_proof.log. Severity Low: specific hardware, physical trigger, panic-only.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4730/static_proof.log (steps 1-6: handler reads INTPORT unconditionally, macro definition, sc_ioport NULL when MMIO, IRQ registered backend-blind, detection works over either backend, rman_get_bustag raw deref); VERDICT.md (full narrative + killed candidates incl. the already-filed fanid leak family DF-1860/2129/2402/2403); verify.sh (runnable)",
  "kernel_refs": [
    "sys/dev/apple/smc/smc_io.c:620",
    "sys/dev/apple/smc/smc.h:113",
    "sys/dev/apple/smc/smc.c:163-186",
    "sys/dev/apple/smc/smc.c:478",
    "sys/sys/rman.h:151"
  ],
  "poc_changes": "No PoC seed existed; authored a runnable static proof script (verify.sh) instead of a hardware PoC since the finding is hardware-gated.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "./verify.sh . (static chain; no target hardware on guest)",
  "run_cmd": "./verify.sh . > static_proof.log 2>&1",
  "code_hash": "7fbdd9560ce164f1e4585e864b59a5b71cafde398b35091aaab7472dcfeb247b",
  "notes": "Contract Phase V skipped: Low severity, hardware-gated (no Apple SMC in QEMU; emulating the SMC MMIO protocol is not possible). Status recorded as untested (allowed enum). Pass-1 fanid/MMIO-underfill stack-leak family (DF-1860, DF-2129, DF-2402, DF-2403) attributed to sibling files \u2014 NOT re-reported.",
  "recommended_fix": "Return early from apple_smc_sms_intr() when sc->sc_ioport is NULL (MMIO backend has no int-port; T2 machines have no SMS).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (early-return NULL guard in apple_smc_sms_intr) but not build-validated: no Apple SMC hardware on the audit guest.",
  "fix_evidence": "findings/poc/DF-4730/fix.diff"
}