{
  "finding_id": "DF-4921",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Latent hardening (Info): ip1000phy_reset matches the parent driver by a 4-character strncmp against the name stge then blind-casts the parent softc to struct stge_softc * to read sc_rev - any hypothetical future driver whose name begins with stge and which parents an IP1000A PHY gets its softc misread at that offset. No in-tree impact (only stge matches today; loading a driver needs root). FreeBSD eliminated exactly this pattern via MIIF_PHYPRIV0 plumbing. Flag-based fix.",
  "exploit_chain": "none in-tree (requires a second stge-prefixed driver)",
  "evidence": "findings/poc/DF-4921/ (this verdict)",
  "kernel_refs": [
    "sys/dev/netif/mii_layer/ip1000phy.c:435-439"
  ],
  "guest_uname": "",
  "code_hash": ""
}