# DF-4782 verdict — sink REPRODUCED; natural trigger requires a custom kernel

## Reproduced?

The crash sink is reproduced on the stock guest: `dcons_putc(NULL, 'A')`
(the exact call `dcons_tty_start()` makes when `si_drv1 == NULL`) takes
`Fatal trap 12`, fault address 0x8, `Stopped at dcons_putc: movl 0x8(%rdi),%eax`
(reading `ch->buf`/`ch->size` at NULL+offset, dcons.c:112-125).

The natural trigger requires a kernel built with `device dcons`
(non-default custom config) so that `dcons_cninit_fini()` (dcons_os.c:383)
creates /dev/dcons without the module-only `dcons_attach_port()` wiring
(dcons_os.c:482-502); the guest runs the stock X86_64_GENERIC kernel, so the
full open+write path was not executed (would need a kernel rebuild). The
code trace is airtight:

- static path: cninit (dcons_os.c:370-380) → cninit_fini make_dev
  (dcons_os.c:385-386) — no si_drv1 assignment anywhere;
- first write → tty start (dcons_os.c:315-334) reads si_drv1 (line 320)
  → NULL → dcons_putc(NULL, c) (line 329) → fault.

Privilege: /dev/dcons is 0600 root:wheel (dcons_os.c:385-386) — root-only,
local, custom kernel. Impact: kernel panic (DoS). Severity Low.

## Evidence

- panic.txt — Fatal trap 12, va=0x8, `Stopped at dcons_putc: movl 0x8(%rdi),%eax`.
- dconsnull.c mode 2 = the sink; mode 0 = negative control (valid buffer OK).

## Fix

Wire `si_drv1` (and ideally pre-allocate the tty) in `dcons_cninit_fini()`
(see fix.diff) — one line, mirroring dcons_attach_port().

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.