{
  "finding_id": "DF-4735",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "likely",
  "verdict": "reproduced (consequence-level): coretemp is compiled into stock X86_64_GENERIC (device coretemp, config:188) and its 2s-periodic sensor task reads MSR_THERM_STATUS/MSR_PKG_THERM_STATUS with the raw faulting rdmsr (coretemp.c:599-601) although the same file documents that CPUID thermal bits can lie (PIII ... report them in cpu_thermal_feature. This leads to a later GPF, coretemp.c:192-196) and already uses rdmsr_safe for IA32_TEMPERATURE_TARGET (:306). Guest proof chain: (1) stock qemu64 CPU - leaf 6 = 0, coretemp gated at identify (:200); (2) guest rebooted with -cpu host on the Intel Skylake host - KVM still presents leaf 6 EAX = 0x4 <ARAT>, i.e. KVM itself strips the DTS bit precisely because the MSR is not virtualized; (3) trigger module (msrtest.ko, -Werror) executing the exact coretemp.c:599 instruction in kernel context: rdmsr_safe(MSR_THERM_STATUS) -> error 14, then raw rdmsr -> Fatal trap 9: general protection fault while in kernel mode ... Stopped at msrtest_modevent+0x5d: rdmsr, guest dead in DDB (panic.txt/run.log). On any VMM/CPU that DOES advertise the DTS bit without implementing the MSR, the stock kernel therefore panics ~2s after boot with zero user interaction; the root-only kld substitutes only the missing CPUID advertisement. Upstream FreeBSD re-engineered this exact surface (live do_cpuid(0x06) + fault-safe x86_msr_op reads). No privilege boundary crossed - panic/DoS class.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4735/panic.txt (full fatal-trap 9 + Stopped at ... rdmsr console capture); run.log (full console incl. the rdmsr_safe error-14 line proving the graceful branch); msrtest.c + build.sh + run.sh; env.txt (leaf-6=0x4<ARAT> under -cpu host; stock leaf-6=0; no coretemp children); fix.diff; build.log (coretemp.c -Werror at :7326, RC=0)",
  "kernel_refs": [
    "sys/dev/powermng/coretemp/coretemp.c:599",
    "sys/dev/powermng/coretemp/coretemp.c:601",
    "sys/dev/powermng/coretemp/coretemp.c:192",
    "sys/dev/powermng/coretemp/coretemp.c:200",
    "sys/dev/powermng/coretemp/coretemp.c:306",
    "sys/dev/powermng/coretemp/coretemp.c:455",
    "sys/config/X86_64_GENERIC:188"
  ],
  "poc_changes": "trigger authored fresh (no seed): minimal kld, built with bsd.kmod.mk -Werror on the guest, kldload as root on the -cpu host guest",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 4300,
  "guest_dirty": 1,
  "build_cmd": "cd /tmp/msrmod && printf KMOD=\\tmsrtest\\nSRCS=\\tmsrtest.c\\n\\n.include <bsd.kmod.mk>\\n > Makefile && make SYSDIR=/usr/src/sys",
  "run_cmd": "kldload /tmp/msrmod/msrtest.ko   # -> rdmsr_safe error 14, then Fatal trap 9 GPF, DDB, guest down",
  "code_hash": "548ca49761fd3b644022e87b60951e6a8e9d4ddb5d8e672d9b437ed9c0fe86f5",
  "notes": "in-driver execution not observable on this guest because KVM masks the DTS bit (proven); the trigger reproduces the exact instruction/MSR/context and its trap on a platform (KVM) whose own masking policy demonstrates the lying-CPUID class is real and anticipated by VMM vendors. The same run demonstrates the fix semantics: rdmsr_safe on the same MSR returns error 14 without trapping. Patched kernel (#1 Sep 23 04:06:03, fix applied) installed and booted clean. Everything else in coretemp.c audited clean - see VERDICT.md negative notes (topology KKASSERT invariant proof, sensor-task/unregister drain protocol, no unpriv-reachable input surface, no amdtemp DF-4461 assert-on-invalid twin here, bounded notify buffers).",
  "recommended_fix": "coretemp_msr_fetch: use rdmsr_safe for both MSRs and return the error; sensor tasks map a failed fetch to CORETEMP_TEMP_INVALID (sensors go invalid instead of kernel #GP).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "baseline reproduced (raw rdmsr(0x19c) -> Fatal trap 9 on the stock kernel, guest dead); fix build-validated (nativekernel RC=0, coretemp.c -Werror at build.log:7326) and the patched kernel installed+booted clean; the graceful-degradation branch of the fix is demonstrated live by the same run (rdmsr_safe on the identical MSR returns error 14, no trap). In-delta coretemp runtime comparison not observable on this guest (KVM masks the DTS bit so coretemp never attaches).",
  "fix_evidence": "findings/poc/DF-4735/build.log (:7326 coretemp.c -Werror, RC=0); panic.txt (baseline trap); run.log line rdmsr_safe -> error 14 (patched semantics); fix.diff"
}