{
  "finding_id": "DF-4782",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "On a kernel built with `device dcons`, dcons_cninit_fini (dcons_os.c:383-387) creates /dev/dcons but si_drv1 is only wired by the module-only dcons_attach_port (dcons_os.c:490-493); the first tty write runs dcons_tty_start (dcons_os.c:315-334) which derefs si_drv1==NULL and calls dcons_putc(NULL,c) (dcons_os.c:329). The sink is reproduced on the stock guest via the exported dcons_putc(NULL,A): Fatal trap 12, va=0x8, Stopped at dcons_putc: movl 0x8(%rdi),%eax. The full open+write path needs a custom kernel (device dcons) \u2014 not rebuilt on the guest; the code trace shows no other assignment of si_drv1 in the static path. Root-only (node 0600), custom-kernel, local panic/DoS.",
  "exploit_chain": "",
  "evidence": "panic.txt (Fatal trap 12 va=0x8 at dcons_putc); run.log (mode 2 marker then trap); code trace dcons_os.c:320 -> :329 -> dcons.c:118",
  "kernel_refs": [
    "sys/dev/misc/dcons/dcons_os.c:320",
    "sys/dev/misc/dcons/dcons_os.c:329",
    "sys/dev/misc/dcons/dcons_os.c:385",
    "sys/dev/misc/dcons/dcons_os.c:493",
    "sys/kern/tty_cons.c:229"
  ],
  "poc_changes": "Same harness as DF-4781 (mode 2 added for this sink).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "build_cmd": "cd /root/dconsrig && make",
  "run_cmd": "kenv dconsnull.mode=2; kldload /root/dconsrig/dconsnull.ko",
  "code_hash": "9e316bf715ac7ed67b343dac6b2480bc816d9420e9ea0ac0b10a8df7bb213b2f",
  "notes": "Natural trigger requires custom kernel config (`device dcons`); sink proven directly. fix.diff (one-line si_drv1 wiring in cninit_fini) authored against read-only sys/, not build-validated.",
  "recommended_fix": "Wire cp->cn_dev->si_drv1 = &sc[DCONS_CON] in dcons_cninit_fini().",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not validated: sink-level reproduction on stock kernel; full-path validation needs a custom-kernel rebuild, skipped for budget (panic-only, root-only, custom-config)",
  "fix_evidence": "fix.diff (one-line si_drv1 wiring)"
}