# DF-4930 VERDICT — atphy no-media attach → panic("ifmedia_set")

**Status: NOT REPRODUCED end-to-end (hardware absent on guest); kernel-side sink PROVEN to panic on this exact kernel; fix mechanism validated.**

## Root cause (source trace)

- `atphy_attach` (sys/dev/netif/mii_layer/atphy.c:135-144): if the PHY's
  BMSR reports no 10/100 media bits and EXTSR no gigabit bits, the driver
  prints "no media present" and **skips `mii_phy_add_media`** — the only
  routine that would have installed the IFM_NONE fallback entry
  (mii_physubr.c mii_phy_add_media: `if ((sc->mii_flags & MIIF_NOISOLATE)
  == 0) ADD(IFM_ETHER|IFM_NONE, ...)`).
- atphy.c:149 still calls `MIIBUS_MEDIAINIT(sc->mii_dev)` →
  `miibus_mediainit` (sys/dev/netif/mii_layer/mii.c:229-246), which walks
  the (now EMPTY) ifm_list, leaves `media = 0`, and calls
  `ifmedia_set(&mii->mii_media, 0)`.
- DragonFly's `ifmedia_set` (sys/net/if_media.c) has NO no-match fallback:
  `ifmedia_match` returns NULL on the empty list → `kprintf("ifmedia_set:
  no match ...")` → **`panic("ifmedia_set")`**. (FreeBSD's version prints
  and returns; the panic is a DragonFly-specific divergence.)
- Neither parent driver (age, ale) implements a `miibus_mediainit` hook
  that could add fallback media (grep: no MEDIAINIT in if_age.c/if_ale.c).
- Secondary effect of the same branch: had the boot survived,
  `atphy_service` dereferences `mii->mii_media.ifm_cur` (atphy.c:156→164,
  224) which would be NULL; the attach-time panic preempts this.

Precondition: an Attansic/Atheros F1/F1_7/F2 PHY whose ID registers match
(so atphy attaches) but whose BMSR/EXTSR report zero media capability — a
broken/partially-fried PHY or flaky MDIO. Not attacker-craftable in
software; it is a hardware-fault boot/attach-time panic (auto-attach at
boot or kldload). Same family and severity class as DF-1973 (mlphy
KKASSERT) and DF-4923 (tlphy NULL-deref), and the "no media present"
branch exists in ~20 sibling PHY drivers — the fix belongs in each
driver's attach (this pack fixes atphy; siblings should get the same
one-liner).

## Verification on the guest

No Attansic PHY hardware exists under QEMU and PHY register behavior cannot
be emulated, so the atphy path itself could not be exercised (honest
not_reproduced). The kernel-side sink WAS executed with the real kernel
functions via the `uafsink` KLD (run.sh → `sysctl hw.uafsink_fire=1`):

    ifmedia_set: no match for 0x0/0xffffffff
    panic: ifmedia_set
    ifmedia_set() at ifmedia_set+0x53
    uafsink_fire() at uafsink_fire+0x8e ...

Guest down (see panic.txt). This is byte-for-byte the terminal behavior the
atphy chain would produce.

## Fix

`fix.diff` (atphy.c): call `mii_phy_add_media(sc)` unconditionally after
the "no media present" print (restores the FreeBSD parent behavior; with
zero capabilities it adds exactly the IFM_NONE fallback entry).
Mechanism validated on the guest with the real kernel functions
(`sysctl hw.uafsink_fixcheck=1`): with the fallback entry present,
`ifmedia_set(IFM_ETHER|IFM_NONE)` finds its match, does not panic, and
leaves `ifm_cur` non-NULL (protecting atphy_service). The atphy.c edit
itself was not exercised end-to-end (no PHY hardware) — fix_status
not_testable with the mechanism demonstrated.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.