{"finding_id":"DF-4825","status":"untested","attempts":0,"reproduced":0,"impact":"panic","confidence":"speculative","verdict":"Hardening (DF-4735 family): clockmod_select_handler issues a bare wrmsr(MSR_THERM_CONTROL) per target CPU - any VMM advertising CPUID ACPI+TM but faulting the MSR turns the root sysctl select write and the kldunload raise-to-100% into a kernel #GP panic. Safe on real silicon (gate matches SDM). Guest-negative-verified: this QEMU CPU lacks both bits so clockmod never attaches (no machdep.clockmod_dom0 oid, kldload inert) - unreachable here. rdmsr_safe/wrmsr_safe-with-error-propagation fix.","exploit_chain":"CPUID-lying VMM -> root sysctl machdep.clockmod_domN.select=50.00% (or kldunload) -> wrmsr #GP -> panic","evidence":"findings/poc/DF-4825/ (this verdict)","kernel_refs":["sys/dev/powermng/clockmod/clockmod.c:472","sys/dev/powermng/clockmod/clockmod.c:230-231","sys/dev/powermng/clockmod/clockmod.c:454-455"],"guest_uname":"","code_hash":""}