{
  "finding_id": "DF-4738",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Allocator logic defect certain and demonstrated by a guest-run verbatim replica of the static curr_bus_number renumbering block (run.log: a cbb socket left SECBUS=0 by firmware is assigned bus 2 that a firmware-configured bridge already owns -> COLLISION: two bridges now own bus 2; and socket #127 draws secbus_reg=256 which truncates to u_int8_t secbus=0, the drivers own unconfigured sentinel). Real-world manifestation is firmware/hardware-gated: it requires a machine with a CardBus bridge whose firmware left the socket unprogrammed while assigning overlapping low bus numbers elsewhere (historically real on yenta-era laptops; FreeBSD rewrote this allocator, DragonFly still carries the 2005 code whose own comment says XXX EVILE BAD), or >126 sockets for the truncation axis. The QEMU audit guest has no class 0x0607 device at all (guest_hw_evidence.txt), so cbb(4) never attaches and the in-kernel path cannot run; hence not_reproduced with certain allocator logic and speculative-to-likely field manifestation. Worst-case impact if triggered: CardBus config cycles alias an unrelated bridges subordinate bus, letting a cards driver read/program an unrelated devices config space (BARs/command) -> system-wide misbehavior or DMA-address corruption; no unprivileged-user trigger exists.",
  "exploit_chain": "",
  "evidence": "run.log (guest cc 8.3 build; collision case and 256->0 truncation case); guest_hw_evidence.txt (pciconf: no class 0x0607 CardBus device, cbb never attaches); VERDICT.md (line-by-line root cause at pccbb_pci.c:299/345-358, pccbbvar.h:68-69)",
  "kernel_refs": [
    "sys/dev/pccard/pccbb/pccbb_pci.c:299",
    "sys/dev/pccard/pccbb/pccbb_pci.c:345",
    "sys/dev/pccard/pccbb/pccbb_pci.c:353",
    "sys/dev/pccard/pccbb/pccbb_pci.c:357",
    "sys/dev/pccard/pccbb/pccbbvar.h:68"
  ],
  "poc_changes": "No seed existed; authored host-side replica of the renumbering block with fixture bridges, compiled and executed on the guest.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -Wextra -o /tmp/df4738 /tmp/df4738.c (on guest)",
  "run_cmd": "/tmp/df4738 (on guest)",
  "code_hash": "b8a1e04527db70fc8543481d7bd49bb3465bdd6b53b47e3577cdb96ca9b7a031",
  "notes": "Guest returned clean (module state untouched for this pack; amdpm.ko loaded/unloaded belonged to the DF-4737 evidence run).",
  "recommended_fix": "Bound the allocator (fail attach when curr_bus_number > 254, fix.diff) and replace the driver-static counter with centralized bus-number allocation that accounts for buses already assigned elsewhere in the tree (FreeBSDs later pccbb rework).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: no CardBus bridge exists on the guest, so a single-fix kernel build has no attach to observe; the guards boundary arithmetic (254+1=255 max, no truncation) is validated by the demos truncation case.",
  "fix_evidence": "fix.diff"
}