# DF-4865 VERDICT — not_reproduced (trigger precondition absent on this guest); code-level defect certain

## What was tested

Live verification on the QEMU guest (DragonFly 6.5-DEVELOPMENT, X86_64_GENERIC,
`QEMU Virtual CPU version 2.5+`, 6 CPUs, securelevel -1, gcc 8.3):

1. **Device perms (task item g):** `cpuctl` is an *optional* module
   (`sys/conf/files:408`), not present in X86_64_GENERIC; after `kldload cpuctl`
   the nodes `/dev/cpuctl0..5` appear as `crw-r----- root kmem` — mode 0640
   (cpuctl.c:480-481). An unprivileged user (`maxx`, uid 1001, no kmem group)
   **cannot open the device at all** (`Permission denied`). The MSR porthole is
   root:kmem-gated exactly as coded; identical to upstream FreeBSD.

2. **The #GP family question (DF-4735/DF-4825 context):** all four MSR ioctls
   (RDMSR/WRMSR/MSRSBIT/MSRCBIT) issued against invalid MSR 0x11111111 returned
   `-1 / EFAULT` and the guest stayed alive. cpuctl.c uses `rdmsr_safe`/`wrmsr_safe`
   (cpuctl.c:197,199,202,204,208,210) whose #GP is fielded by `msr_onfault`
   (sys/platform/pc64/x86_64/support.s:861-866). **No bare rdmsr/wrmsr exists in
   this file** — the coretemp/clockmod panic family does not reach here.

3. **The finding itself (uninit stack print):** `CPUCTL_UPDATE` with a garbage
   64-byte blob returned `EEXIST` (rev1 == rev0, cpuctl.c:307-310) and the kernel
   printed `[cpu 0]: updated microcode from rev=0x1 to rev=0x1` — *initialized*
   values. Root cause analysis is code-certain:
   - cpuctl.c:289 `rdmsr_safe(MSR_BIOS_SIGN, &rev0);` — return ignored;
   - cpuctl.c:302 `rdmsr_safe(MSR_BIOS_SIGN, &rev1);` — return ignored;
   - cpuctl.c:400/422/425 same pattern for `rev0`/`res`/`rev1` in `update_via()`;
   - `rdmsr_safe` writes `*val` only on success (support.s:820-836: the store at
     `movq %rax,(%rsi)` is skipped when `rdmsr` faults into `msr_onfault`).
   On fault, `rev0`/`rev1`/`res` remain uninitialized stack; cpuctl.c:304 kprintf's
   `(unsigned)(rev0>>32)`/`(unsigned)(rev1>>32)` (≤64 bits of kernel stack to
   dmesg) and cpuctl.c:307/431 make the success decision on garbage.
   The branch requires MSR 0x8B (architectural since P6) or 0x1205 to #GP —
   cannot be made to fault on this QEMU CPU, so **not_reproduced / impact none
   here**; classified Info (root-only, exotic-fault precondition).

4. **Negative results (pass-2 classes killed on this file)** — see the JSON
   `negative_notes` for the full list: MSR RMW race serialized (global
   cpuctl_lock cpuctl.c:103 + crit_enter cpuctl.c:201/207); CPUID copyout framing
   exact and pre-zeroed (cpuctl.c:153; sys_generic.c:668-724); UPDATE bounds
   0 < size ≤ 4MB with no size_t overflow and single clean free (cpuctl.c:265-313);
   negative dev2unit unreachable (units only 0..ncpus-1, cpuctl.c:480).

## Exploit chain

None — no memory corruption; worst case is ≤64 bits of kernel stack to the
console/dmesg, readable only by root-equivalent users (the ioctl requires
SYSCAP_NOCPUCTL_UPDATE and an FWRITE open of a 0640 root:kmem node).

## Fix

`fix.diff`: zero-initialize `rev0`/`rev1` (update_intel) and `rev0`/`rev1`/`res`
(update_via). Fix validation (kernel rebuild) not performed: the finding did not
reproduce on this guest (no observable misbehavior to diff against) —
`fix_status: not_testable`.

## Artifacts

- `cpuctl_probe.c` — probe source (sha256
  2a7d932d6d99d028fa8e59a1c9323385e9c628f1f7700a1557ef1b7a421f39a3)
- `build.log` / `run.log` (root run incl. dmesg kprintf) / `run.2.log` (unpriv user)
- `env.txt` — guest uname, securelevel, module state, node perms

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.