{
  "finding_id": "DF-4930",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "NOT REPRODUCED end-to-end: the trigger requires Attansic/Atheros F1-family PHY hardware whose BMSR/EXTSR report zero media capability while its ID registers still match, and no such PHY exists on the QEMU guest (PHY register behavior is not emulatable). The kernel-side sink of the chain is nonetheless PROVEN on this exact kernel: replaying miibus_mediainits terminal ifmedia_set() on an EMPTY media list (what atphy_attachs no-media branch at atphy.c:140-149 leads to via mii.c:229-246) yields panic(\"ifmedia_set\") with trace ifmedia_set<-uafsink_fire<-sysctl and kills the guest (panic.txt). DragonFlys ifmedia_set panics on no-match where FreeBSD returns. The finding is therefore certain as a code path and likely as a field event (hardware-fault precondition), severity Low (boot/attach-time DoS, no user-controlled trigger).",
  "exploit_chain": "",
  "evidence": "panic.txt (sink panic: ifmedia_set: no match for 0x0/0xffffffff -> panic, full trace), run.log (rc=124, guest down), run.sh (exact replay of mii.c:229-246 with empty list), build.log, VERDICT.md (atphy.c:135-149 -> mii.c:229-246 -> sys/net/if_media.c trace)",
  "kernel_refs": [
    "sys/dev/netif/mii_layer/atphy.c:135-149",
    "sys/dev/netif/mii_layer/mii.c:229-246",
    "sys/net/if_media.c:ifmedia_set"
  ],
  "poc_changes": "PoC authored fresh (no seed): uafsink KLD replaying the sink; grew a fixcheck sysctl after the first build (missing sys/conf.h include for DEV_MODULE fixed).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 400,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh   (guest: make -m /usr/share/mk)",
  "run_cmd": "sh run.sh     (guest: kldload uafsink.ko; sysctl hw.uafsink_fire=1)",
  "code_hash": "4f119b0c6848ce71ff40445f90eb32d324997ef4341fffede02fd8fe1698b7c8",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (atphy.c: call mii_phy_add_media unconditionally; with zero capabilities it installs the IFM_NONE fallback entry) could not be exercised end-to-end (no PHY hardware). Its operative mechanism WAS validated on the guest with the real kernel functions: with the fallback entry present, the identical ifmedia_set sequence survives and leaves ifm_cur non-NULL (hw.uafsink_fixcheck=1, see build.log/run transcript in VERDICT.md).",
  "fix_evidence": "VERDICT.md Fix section; fix.diff; uafsink.c fixcheck sysctl output (survived; ifm_cur=0xfffff8008d6c11e0)",
  "notes": "Same no media present branch exists in ~20 sibling mii drivers (acphy, amphy, brgphy, ciphy, dcphy, e1000phy, exphy, inphy, jmphy, lxtphy, mlphy, nsgphy, nsphy, pnaphy, pnphy, qsphy, rgephy, rlphy, ruephy...); each should get the same one-line fix, or alternatively harden mii.cs miibus_mediainit/ifmedia_set. Family precedent: DF-1973 (mlphy), DF-4923 (tlphy), both Low.",
  "recommended_fix": "atphy_attach: call mii_phy_add_media() unconditionally so the IFM_NONE fallback entry always exists (see fix.diff); mirror in sibling mii drivers or make miibus_mediainit tolerate an empty list."
}