{
  "finding_id": "DF-4923",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "tlphy_attach() passes each miibus siblings device_get_name() straight into strcmp() (tlphy.c:177); siblings not yet probed have devclass==NULL so device_get_name() returns NULL (subr_bus.c:1632-1637) and strcmp(NULL, ...) panics at device-attach time. Trigger needs >=2 TLAN10T PHYs plus a later-addressed PHY on one ThunderLAN MII bus; the audit guest has no TI 0x100c PCI device at all (pciconf evidence in run.log/env.txt), so the path is unreachable there and the finding stays speculative/Low. Fix: skip NULL-named siblings (fix.diff).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4923/VERDICT.md carries the full path:line trace (mii.c:130-167 child pre-addition vs sequential bus_generic_attach; tlphy.c:170-186 walk; subr_bus.c:1632 NULL return); run.log shows 7 PCI devices and zero vendor 0x100c/0x168c matches on the stock X86_64_GENERIC guest",
  "kernel_refs": [
    "sys/dev/netif/mii_layer/tlphy.c:177",
    "sys/kern/subr_bus.c:1632",
    "sys/dev/netif/mii_layer/mii.c:160",
    "sys/config/X86_64_GENERIC:243"
  ],
  "poc_changes": "no seed PoC existed; replaced with a hardware-precondition check (check_hardware.sh) plus a source-trace proof since the trigger is physical-NIC topology",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root:dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "none (hardware-gated kernel code path)",
  "run_cmd": "dfbsd-qemu/vm.sh run_root pciconf -l | grep -cE \"vendor=0x100c|vendor=0x168c\"  (see run.log)",
  "code_hash": "",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the NULL guard at tlphy.c:177, but baseline itself cannot be triggered without the exotic ThunderLAN multi-PHY hardware, so patched-kernel validation is impossible on this guest; fix correctness is established by the source trace alone",
  "fix_evidence": "findings/poc/DF-4923/fix.diff",
  "notes": "Not a Phase-V-mandatory finding (Low severity, hardware-gated, boot-time only); guest evidence collected anyway to document unreachability. Guest not dirtied (read-only commands); no reset needed.",
  "recommended_fix": "Skip siblings whose device_get_name() is NULL in tlphy_attachs capability walk"
}