# DF-4957 VERDICT — ciphy no-media attach → panic("ifmedia_set")

**Status: NOT REPRODUCED end-to-end (no Cicada/Vitesse PHY hardware on
the guest; PHY registers are not emulatable). The kernel-side sink of
the chain is PROVEN live on this exact kernel — replaying
miibus_mediainit's terminal ifmedia_set() on an EMPTY media list (what
ciphy_attach's no-media branch at ciphy.c:142-147 leads to via
mii.c:229-246) yields `ifmedia_set: no match for 0x0/0xffffffff` →
`panic("ifmedia_set")` and kills the guest (panic.txt, full trace).
Fix mechanism validated live the same boot.**

## Root cause (source trace)

- `ciphy_attach` (sys/dev/netif/mii_layer/ciphy.c:142-147): if the PHY's
  BMSR reports no 10/100 media bits AND EXTSR no gigabit bits, the
  driver prints "no media present" and **skips `mii_phy_add_media`** —
  the only routine that would populate the miibus ifmedia list.
- ciphy.c:149 still calls `MIIBUS_MEDIAINIT(sc->mii_dev)` →
  `miibus_mediainit` (sys/dev/netif/mii_layer/mii.c:229-246): walks the
  now-EMPTY `ifm_list`, `media` stays 0, calls
  `ifmedia_set(&mii->mii_media, 0)`.
- DragonFly's `ifmedia_set` (sys/net/if_media.c) has no no-match
  fallback: `ifmedia_match` returns NULL on the empty list →
  `kprintf("ifmedia_set: no match ...")` → **`panic("ifmedia_set")`**.
  (FreeBSD's ifmedia_set prints and returns; the panic is a DragonFly
  divergence.)
- No parent of a CICADA/VITESSE PHY implements the `miibus_mediainit`
  hook (in-tree hooks exist only in if_xl/if_tx/if_dc; realistic ciphy
  parents are nfe/sk/vge — none hook it).
- Secondary effect of the same branch: had the boot survived,
  `ciphy_service` dereferences `mii->mii_media.ifm_cur` (ciphy.c:156,
  164, 255) which would be NULL.

## Why the atphy (DF-4930) one-line fix does NOT apply here

ciphy sets `sc->mii_flags |= MIIF_NOISOLATE` at ciphy.c:132 BEFORE the
media branch. `mii_phy_add_media`'s IFM_NONE fallback entry is added
only `if ((sc->mii_flags & MIIF_NOISOLATE) == 0)`
(mii_physubr.c:230-232). Therefore "just call mii_phy_add_media()
unconditionally" (the atphy fix) adds NOTHING for ciphy: the list stays
empty and the panic remains. **Every MIIF_NOISOLATE mii driver with this
branch (ciphy, rgephy set NOISOLATE too, …) needs an explicit fallback
entry or the shared `miibus_mediainit` must tolerate an empty list.**

## Verification on the guest

No CS8201/VSC8601 PHY exists under QEMU and MDIO register behavior
cannot be emulated, so the ciphy_attach path itself could not be
exercised (honest not_reproduced). The kernel-side sink WAS executed
with the real kernel functions via the `ciphysink` KLD (adapted from the
DF-4930 pack; run.sh):

1. `sysctl hw.ciphysink_fixcheck=1` — replays the FIXED ciphy path
   (ifmedia_init + explicit IFM_NONE entry + ifmedia_set): **survived**,
   `ifm_cur=0xfffff8004f102640` (non-NULL, which also protects
   ciphy_service's deref).
2. `sysctl hw.ciphysink_fire=1` — replays the STOCK ciphy path
   (empty-list ifmedia_set):

```
ifmedia_set: no match for 0x0/0xffffffff
panic: ifmedia_set
ifmedia_set() at ifmedia_set+0x53
ciphysink_fire() at ciphysink_fire+0x8e
sysctl_root ... userland_sysctl ... sys___sysctl
Debugger("panic") ; guest down
```

This is byte-for-byte the terminal behavior the ciphy chain produces on
a zero-media Cicada PHY at attach (boot-time or kldload).

## Fix

`fix.diff` (ciphy.c): in the no-media branch, after the "no media
present" print, add an explicit
`ifmedia_add(&mii->mii_media, IFM_MAKEWORD(IFM_ETHER, IFM_NONE, 0,
sc->mii_inst), MII_MEDIA_NONE, NULL)` — miibus_mediainit's ifmedia_set
then finds its match, no panic, and ifm_cur is non-NULL for
ciphy_service. Mechanism validated live (fixcheck above). The
framework-level alternative (make miibus_mediainit skip/tolerate an
empty list) would fix all ~20 sibling drivers at once and is the better
long-term fix; the per-driver diff keeps this pack self-contained.

Guest was reset with-src after the panic capture (boot.log rotated);
source of the panic text: serial console capture in panic.txt.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.