{
  "finding_id": "DF-4735",
  "title": "coretemp: raw rdmsr(MSR_THERM_STATUS/MSR_PKG_THERM_STATUS) in the 2s-periodic sensor task panics the stock kernel on CPUID-lying platforms (VMMs advertising DTS without the MSR)",
  "verdict": "reproduced (consequence): raw rdmsr(0x19c) in kernel context -> Fatal trap 9 GPF -> DDB, guest down; in-driver execution gated by KVM's DTS masking; fix build-validated + graceful path demonstrated",
  "impact": "panic (local DoS of the whole system ~2s after boot on an affected VMM; no user interaction required there)",
  "reproduce": {
    "build": "cd /tmp/msrmod && make SYSDIR=/usr/src/sys   (bsd.kmod.mk, -Werror)",
    "run": "kldload /tmp/msrmod/msrtest.ko   (on a CPU where MSR 0x19c faults, e.g. under KVM)",
    "expected": "rdmsr_safe -> error 14; then 'Fatal trap 9: general protection fault while in kernel mode' / 'Stopped at msrtest_modevent+0x5d: rdmsr' / DDB / guest down"
  },
  "kernel_refs": [
    "sys/dev/powermng/coretemp/coretemp.c:599",
    "sys/dev/powermng/coretemp/coretemp.c:601",
    "sys/dev/powermng/coretemp/coretemp.c:192",
    "sys/dev/powermng/coretemp/coretemp.c:200",
    "sys/dev/powermng/coretemp/coretemp.c:306",
    "sys/dev/powermng/coretemp/coretemp.c:455",
    "sys/config/X86_64_GENERIC:188"
  ],
  "artifacts": ["README.md", "VERDICT.md", "msrtest.c", "build.sh", "run.sh", "panic.txt", "run.log", "fix.diff", "build.log", "env.txt", "manifest.json", "verdict.json"]
}