{
  "finding_id": "DF-4970",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "CONFIRMED at source level; kernel path not instantiable on the audit guest (no PCMCIA controller device model, env.txt). xe_pccard_probe()s flag loop (if_xe_pccard.c:311, for (i = 1; i != XE_CARD_TYPE_FLAGS_DINGO; i = i << 1)) exits at i==4 before testing the DINGO bit, so case XE_CARD_TYPE_FLAGS_DINGO is dead code and scp->dingo is never set for any card, including CEM56/REM56 Dingo combos (table entries if_xe_pccard.c:119-122). Guest-compiled logic harness over the verbatim table proves stock loop never sets dingo (3 runs) while the one-line <= fix sets it for exactly the two CEM56 entries; patched if_xe.ko builds on the guest with -Werror (fix_build.log).",
  "exploit_chain": "",
  "evidence": "run.log lines 0x110006 CEM56 ... stock=0,1,0 fixed=0,1,1 + VIOLATION: CEM56 is a Dingo card but scp->dingo == 0 in the STOCK loop + stock loop ever sets dingo: NO (case is dead code); fix_build.log shows patched module linking if_xe.ko with -Werror",
  "kernel_refs": [
    "sys/dev/netif/xe/if_xe_pccard.c:311",
    "sys/dev/netif/xe/if_xe_pccard.c:119",
    "sys/dev/netif/xe/if_xe_pccard.c:201",
    "sys/dev/netif/xe/if_xe.c:1170",
    "sys/dev/netif/xe/if_xe.c:1265",
    "sys/dev/netif/xe/if_xe.c:1916"
  ],
  "poc_changes": "harness authored fresh (no seed); DragonFly userland queue/TAILQ conventions adapted; stock and fixed loop variants compiled from the same table",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (X86_64_GENERIC)",
  "runtime_sec": 40,
  "guest_dirty": 0,
  "build_cmd": "cc -O -Wall -o dingo_flags dingo_flags.c",
  "run_cmd": "./dingo_flags",
  "code_hash": "0f4021d2ba7826c77c0870c490fe168913fc2da74a7899fd3b1a47610a3b7cb4",
  "notes": "Hardware-gated (PCMCIA). Impact is functional device misconfiguration (CEM56/REM56 non-functional), not kernel memory corruption. The dead Dingo branch also currently masks a use-after-release read in xe_activates RealPort ioport loop (if_xe.c) - both should be fixed together. Follows DF-4438/DF-4613 family precedent for hardware-gated verdicts.",
  "recommended_fix": "Change the flag-propagation loop bound in xe_pccard_probe from i != XE_CARD_TYPE_FLAGS_DINGO to i <= XE_CARD_TYPE_FLAGS_DINGO so the DINGO case is reachable (and separately fix the port_res use-after-release in xe_activates Dingo branch)",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Kernel-level fix validation impossible (no PCMCIA hardware). Validated at two levels instead: (1) the harnesss fixed loop variant sets dingo=1 for exactly the CEM56 entries and changes nothing else; (2) fix.diff applies cleanly to the guest /usr/src copy and if_xe.ko builds with -Werror (fix_build.log). Guest sources restored after the build.",
  "fix_evidence": "fix_build.log (patch + cc -Werror + ld -r if_xe.ko, RESTORED_CLEAN); run.log fixed column"
}