{
  "finding_id": "DF-4779",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Reproduced on the stock QEMU guest (Intel vendor, family 0x0F): the missing family-06h gate in corecstat_probe()/corecstat_attach() lets corecstat attach all 6 per-cpu devices on unsupported Intel families, probing Nehalem MSRs (all gracefully rejected by rdmsr_safe), installing a phantom empty cpu_node0 sensordev (hw.sensors.dev_idmax 6->7) and a useless 1 Hz task per cpu. No panic, no corruption (M_ZERO softc pins sc_version=0; static arrays bound sensor counts for any version value) - functional/robustness defect only. Fix (family gate in probe+attach) validated on the guest: with it, kldload attaches nothing and dev_idmax stays 6.",
  "exploit_chain": "",
  "evidence": "run.log: corecstat0..5: <CPU Package C-State residency counters> on cpuN on family 0x0F + 17x msr ... not available + hw.sensors.dev_idmax 6->7->6; VERDICT.md path:line analysis (corecstat.c:183-236, 259-324, subr_bus.c:1953)",
  "kernel_refs": [
    "sys/dev/powermng/corecstat/corecstat.c:183",
    "sys/dev/powermng/corecstat/corecstat.c:233",
    "sys/dev/powermng/corecstat/corecstat.c:259",
    "sys/dev/powermng/corecstat/corecstat.c:321",
    "sys/kern/subr_bus.c:1953"
  ],
  "poc_changes": "No trigger program needed: the stock module kldload on the stock guest CPU is the trigger. build.sh/run.sh captured verbatim.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh (make SYSCDIR=/usr/src/sys in /tmp/ccs, stock source)",
  "run_cmd": "sh run.sh (kldload /tmp/ccs/corecstat.ko; sysctl hw.sensors.dev_idmax; dmesg; kldunload corecstat)",
  "code_hash": "d5361f32802197edbf15d38802b4c5237d57670658626dfba0a1a75118c72327",
  "notes": "Anti-DF-4735 evidence captured in the same run: every residency-MSR read is rdmsr_safe-gated (corecstat.c:594-603) so the raw-rdmsr #GP family cannot fire from this driver. Guest returned clean (vm.sh reset with-src).",
  "recommended_fix": "Reject cpu_family != 0x06 in both corecstat_probe() and corecstat_attach() (see fix.diff).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "With fix.diff (family gate in probe+attach) applied to the module source, the same kldload on the same family-0x0F guest attaches zero devices: no corecstatN lines, no MSR-probe console spam, hw.sensors.dev_idmax remains 6 (baseline attached 6 devices and bumped it to 7). Wrong-attach behavior eliminated.",
  "fix_evidence": "run.log FIX VALIDATION block: 2 (both sites patched), BUILD_OK, KLDLOAD_RC=0, dev_idmax 6 before and after load (no phantom sensordev), UNLOAD_OK.",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 (X86_64_GENERIC) + fixed corecstat.kld module"
}