{
  "finding_id": "DF-4739",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Logic defect certain by C semantics and proven by a guest-compiled exact replica of the alpm_wait loop (run.log: perpetual-BUSY -> error=0x0, SMB_ETIMEOUT never reported; final-poll completion -> error=0x20, spurious failure). The in-kernel path is hardware-gated: no AcerLabs M15x3 PMU (10b9:7101) PCI device exists in the QEMU guest (guest_hw_evidence.txt), so alpm.ko loads but never attaches and the smbus interface is unreachable (/dev/smb* absent). Surface is root-only where it does exist (0600 root:wheel /dev/smbN) plus in-kernel smbus consumers; impact is silent stale-data success on genuine SMBus timeouts (data integrity) plus rare spurious failure of last-poll completions, not memory corruption. Line-for-line same while(count--)/if(!count) defect family as DF-4549 (viapm.c:574/587) and DF-4737 (amdpm.c:308/319); intpm.c shows the correct explicit-return pattern.",
  "exploit_chain": "",
  "evidence": "run.log (guest cc 8.3 build + both failure modes + fixed-loop validation); guest_hw_evidence.txt (pciconf: no 10b9 PMU device; kldload alpm succeeds, no attach, no /dev/smb*); VERDICT.md (line-by-line root cause at alpm.c:305/308/316)",
  "kernel_refs": [
    "sys/dev/powermng/alpm/alpm.c:305",
    "sys/dev/powermng/alpm/alpm.c:308",
    "sys/dev/powermng/alpm/alpm.c:316",
    "sys/dev/powermng/alpm/alpm.c:413",
    "sys/dev/powermng/alpm/alpm.c:467",
    "sys/dev/powermng/alpm/alpm.c:523",
    "sys/dev/powermng/alpm/alpm.c:603"
  ],
  "poc_changes": "No seed existed; authored replica of the alpm_wait loop with fixture register reads plus an in-demo fixed-loop variant, compiled and executed on the guest.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -Wextra -o /tmp/df4739 /tmp/df4739.c (on guest)",
  "run_cmd": "/tmp/df4739 (on guest)",
  "code_hash": "1515d4f848f73d751cdd32712aab9572d447caf2c4d834b095ad23be38e9aa02",
  "notes": "alpm.ko was kldloaded for hardware-gate evidence and kldunloaded afterwards; guest stayed clean (no panic, no reset needed). Attack surface root-only: /dev/smbN is 0600 root:wheel.",
  "recommended_fix": "Change `if (!count)` to `if (count < 0)` in alpm_wait() at alpm.c:316 (loop exhaustion leaves count == -1; completion on the final poll leaves count == 0 and must not be a timeout).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: kernel path requires ALi M1543 PMU hardware absent from the guest; the one-line diff is validated in-silico by the demos fixed-loop variant (case C reports SMB_ETIMEOUT, case D succeeds \u2014 run.log).",
  "fix_evidence": "fix.diff"
}