# DF-4779 — corecstat attaches on any Intel CPU outside family 06h (missing `return ENXIO` for `cpu_family != 0x06`)

**File:** `sys/dev/powermng/corecstat/corecstat.c`
**Severity:** Info (functional/robustness — no memory-safety impact) · **Confidence:** certain
**Bucket:** base:powermng

## What the bug is

Both `corecstat_probe()` (corecstat.c:183-236) and `corecstat_attach()` (corecstat.c:259-324)
gate the model whitelist on `if (cpu_family == 0x06) { switch (cpu_model) { ... default:
return (ENXIO); } }` — but there is **no else branch**. For an Intel CPU with any family
other than 06h (e.g. family 0x0F Pentium 4 / NetBurst Xeon, family 05h), the whitelist is
skipped entirely and `corecstat_probe()` returns `BUS_PROBE_GENERIC` — a match — and
`corecstat_attach()` proceeds with `sc->sc_version` never assigned.

The driver's contract (header comment, corecstat.c:27-31) is "Nehalem and later Core CPUs"
— all of which are family 06h. `corecstat_identify()` gates on
`cpu_vendor_id == CPU_VENDOR_INTEL` (corecstat.c:160) but never on family.

## Why it is memory-safe (why this is Info, not higher)

* The softc is allocated `M_ZERO` by newbus (sys/kern/subr_bus.c:1953-1954), so the
  unassigned `sc_version` is 0 → Nehalem/Westmere treatment. Even a garbage version could
  not overflow: `sc_core_sens[3]` takes at most 3 sensors for any version value
  (corecstat.c:460-471) and `sc_pkg_sens` is kmalloc'd for 7 with at most 7 added
  (corecstat.c:435-456).
* Every MSR read that creates a sensor goes through `corecstat_try()` → `rdmsr_safe()`
  (corecstat.c:594-603), so the DF-4735 raw-rdmsr-#GP family cannot fire here. The only
  raw `rdmsr()` calls (corecstat.c:531, 549) execute solely for sensors whose MSR already
  passed `rdmsr_safe` at attach.

## What actually happens (guest-reproduced)

On the QEMU/KVM guest (`vendor=GenuineIntel`, family 0x0F, model 0x0B — "QEMU Virtual CPU
version 2.5+"), loading the stock, unmodified `corecstat.ko`:

* `corecstat0`..`corecstat5` all attach ("`<CPU Package C-State residency counters> on cpuN`")
* every residency MSR is gracefully rejected by `rdmsr_safe` → 17 console lines
  "`msr node0 ... not available`" (the version-0 Nehalem set: core C3/C6 everywhere, plus
  PC3/PC6/PC7 on the chip-representative cpu5)
* a **phantom empty sensordev** `cpu_node0` is installed and `hw.sensors.dev_idmax`
  bumps 6 → 7 with zero sensors in it
* the 1 Hz refresh task is registered on every cpu with zero sensors to refresh
* `kldunload corecstat` is clean.

No panic, no corruption — pure wrong-attach + console spam + useless per-cpu sensor tasks
on exactly the silicon the driver must reject (Pentium 4-class family 0x0F, etc.).

## Reproduce

```
# on the DragonFly guest (as root), stock kernel, stock cpu (family 0x0F):
sh build.sh          # builds stock corecstat.ko from pristine /usr/src source
sh run.sh            # kldload, show dmesg + hw.sensors.dev_idmax, kldunload
# expected: 6x attach lines, 17x "msr ... not available", dev_idmax 6->7->6, no panic
```

## Fix

`fix.diff` adds the missing family gate to both probe and attach
(validated on the guest: with the fix, kldload produces no devices at all and
`hw.sensors.dev_idmax` stays 6).