{
  "finding_id": "DF-4867",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Latent-by-analysis: ata_intel_chipinit (ata-intel.c:177-180) accepts ANY non-ENXIO return of ata_ahci_chipinit as AHCI success and returns 0 without assigning ctlr->setmode (compat fallback at :182-189 skipped; AHCI assigns it only on the success path at ata-ahci.c:108). A third error code — e.g. any future value propagated verbatim by return(error) at ata-ahci.c:97 from ata_ahci_ctlr_reset — would leave ctlr->setmode NULL and panic the kernel at boot via the unconditional ctlr->setmode(dev, ATA_PIO_MAX) call in ata_pcichannel_setmode (ata-pci.c:863, invoked from ata-all.c:525 / ata-disk.c:436). Not reachable on this tree: exhaustively verified all four exits of ata_ahci_chipinit return only {0, ENXIO}, and the guest (PIIX3, non-SATA branch) has no AHCI-capable Intel SATA hardware. Live-verified instead that the audited boot path runs cleanly every boot: dmesg shows atapci0 <Intel PIIX3 WDMA2 controller> + ata0/ata1 + acd0 WDMA2, and PCI cfg 0x54=0x0400 is the exact vendor bit written by ata_intel_new_setmode (ata-intel.c:310). Hardening fix: == 0 instead of != ENXIO.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (full path:line trace and reachability analysis); dmesg.txt (PIIX3 boot through ata_intel_chipinit non-SATA branch + ata_intel_new_setmode at attach); env.txt (uname, pciconf 0x40:0x5f dump showing 0x54=0400 from ata-intel.c:310); fix.diff (one-line guard fix)",
  "kernel_refs": [
    "sys/dev/disk/nata/chipsets/ata-intel.c:177",
    "sys/dev/disk/nata/chipsets/ata-intel.c:180",
    "sys/dev/disk/nata/chipsets/ata-intel.c:182",
    "sys/dev/disk/nata/chipsets/ata-ahci.c:95",
    "sys/dev/disk/nata/chipsets/ata-ahci.c:97",
    "sys/dev/disk/nata/chipsets/ata-ahci.c:108",
    "sys/dev/disk/nata/ata-pci.c:863"
  ],
  "poc_changes": "No PoC needed (Info hardening, latent). Replaced trigger with a live negative-evidence collector (collect_live.sh) proving the audited chip-init/setmode path executes in-bounds on this guest at every boot.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 18,
  "guest_dirty": 0,
  "build_cmd": "(none - no build; read-only live evidence)",
  "run_cmd": "findings/poc/DF-4867/collect_live.sh",
  "code_hash": "",
  "notes": "Status not_reproduced per honest-classification: cited path traced dead on this tree (callee contract {0,ENXIO} verified at every exit). Guest not dirtied; no panic. DF-1940 (31244 tf_write div0) is the only active finding in this file and was NOT re-reported per pass-2 instructions.",
  "recommended_fix": "Only take the AHCI path on explicit success: ata_ahci_chipinit(dev) == 0 (not != ENXIO) in ata_intel_chipinit",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation N/A: the latent path cannot be made to fail on the baseline tree without modifying sys/ (read-only). The == 0 guard is semantics-preserving for every return value producible today and eliminates the contract hole.",
  "fix_evidence": "findings/poc/DF-4867/fix.diff"
}