{
  "finding_id": "DF-4957",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "NOT REPRODUCED end-to-end: the trigger requires CS8201/CS8201A/CS8201B/VSC8601 PHY hardware (ciphys[] table, ciphy.c:72-80) whose ID registers match while BMSR/EXTSR report zero media capability, and no such PHY exists on the QEMU guest (MDIO register behavior is not emulatable). The kernel-side sink of the chain is nonetheless PROVEN on this exact kernel: replaying miibus_mediainits terminal ifmedia_set() on an EMPTY media list (what ciphy_attachs no-media branch at ciphy.c:142-147 leads to via mii.c:229-246) yields ifmedia_set: no match for 0x0/0xffffffff -> panic(\"ifmedia_set\") with trace ifmedia_set<-ciphysink_fire<-sysctl and kills the guest (panic.txt). DragonFlys ifmedia_set panics on no-match where FreeBSD returns. IMPORTANT divergence from the atphy sibling (DF-4930): ciphy always sets MIIF_NOISOLATE (ciphy.c:132) and mii_phy_add_medias IFM_NONE fallback is gated on that flag being CLEAR (mii_physubr.c:230-232), so the atphy-shaped unconditional-add fix does NOT work here; fix.diff adds an explicit IFM_NONE entry instead, and that mechanism was validated live (hw.ciphysink_fixcheck=1 survives with non-NULL ifm_cur). Boot/attach-time hardware-fault DoS, no user-controlled trigger; family precedent DF-1973/DF-4923/DF-4930, all Low.",
  "exploit_chain": "",
  "evidence": "panic.txt (sink panic: ifmedia_set: no match for 0x0/0xffffffff -> panic, full trace incl. ciphysink_fire; fixcheck survived with ifm_cur=0xfffff8004f102640 just before), run.log (fixcheck output then connection death on fire), VERDICT.md (ciphy.c:142-149 -> mii.c:229-246 -> if_media.c trace), fix.diff (explicit IFM_NONE fallback entry)",
  "kernel_refs": [
    "sys/dev/netif/mii_layer/ciphy.c:132",
    "sys/dev/netif/mii_layer/ciphy.c:142-149",
    "sys/dev/netif/mii_layer/mii.c:229-246",
    "sys/dev/netif/mii_layer/mii_physubr.c:230-232",
    "sys/net/if_media.c:ifmedia_set"
  ],
  "poc_changes": "PoC authored fresh (adapted from the DF-4930 uafsink pack): renamed sysctls to hw.ciphysink_fire/fixcheck, updated the replayed chain comments to ciphy.c lines; first build failed on #include <sys/bus.h> (needs generated device_if.h) -- removed the unneeded include, second build clean.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (ciphy.c: add an explicit ifmedia_add(IFM_ETHER|IFM_NONE) in the no-media branch -- NOT the atphy-shaped unconditional mii_phy_add_media call, which is a no-op here because of the MIIF_NOISOLATE gate at mii_physubr.c:230-232) could not be exercised end-to-end (no Cicada PHY hardware). Its operative mechanism WAS validated live on the same boot with the real kernel functions: hw.ciphysink_fixcheck=1 replays ifmedia_init + the explicit IFM_NONE entry + ifmedia_set and survives with ifm_cur non-NULL (panic.txt preamble), while the unfixed sequence panics two sysctls later.",
  "fix_evidence": "panic.txt (fixcheck survived; ifm_cur=0xfffff8004f102640 followed by the sink panic); fix.diff; VERDICT.md Fix section",
  "notes": "Framework-level fix is preferable long-term: make miibus_mediainit tolerate an empty ifm_list (or harden ifmedia_set), which would cover all ~20 sibling mii drivers with this branch in one place; the per-driver diff keeps this pack self-contained. Family: DF-1973 (mlphy), DF-4923 (tlphy), DF-4930 (atphy). Guest reset with-src after panic capture.",
  "recommended_fix": "ciphy_attach no-media branch: add explicit ifmedia_add(&mii->mii_media, IFM_MAKEWORD(IFM_ETHER, IFM_NONE, 0, sc->mii_inst), MII_MEDIA_NONE, NULL); (see fix.diff); or harden miibus_mediainit for empty lists tree-wide."
}