{
  "finding_id": "DF-4866",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "Hardware-gated attach leak: siba_bwn_attach enables busmaster and allocates the backplane BAR, then does return siba_core_attach(siba) with no unwind - and siba_core_attach can fail from hardware data (bad-SPROM CRC propagates EPROTO; the bwn child rejects unsupported PHYs like the common BCM4312 LP-PHY). newbus never detaches a failed attach, so the MMIO BAR, busmaster, and every scanned child leak until reboot; kldunload/re-probe cannot reclaim. No Broadcom NIC on the guest. Unwind-on-failure fix.",
  "exploit_chain": "BCM43xx card with corrupt SPROM or unsupported PHY -> attach fails after BAR alloc -> permanent MMIO window + device leak",
  "evidence": "findings/poc/DF-4866/ (this verdict)",
  "kernel_refs": [
    "sys/dev/netif/bwn/siba/siba_bwn.c:151",
    "sys/dev/netif/bwn/siba/siba_bwn.c:157",
    "sys/dev/netif/bwn/siba/siba_bwn.c:173",
    "sys/dev/netif/bwn/siba/siba_core.c:217-226"
  ],
  "guest_uname": "",
  "code_hash": ""
}