# DF-4981 — jmphy "no media present" branch → empty media list → panic("ifmedia_set") at attach

File: sys/dev/netif/mii_layer/jmphy.c:124-129
Family: DF-4930 (atphy), DF-4957 (ciphy) — same construct, same sink.
Parent NIC: jme(4) (sys/dev/netif/jme/if_jme.c) — mii_phy_probe at :1028,
NO miibus_mediainit method (:218-220), so nothing but the PHY populates
the media list.

## Chain

jmphy_attach reads BMSR (jmphy.c:119); if the PHY reports zero media bits
AND (BMSR_EXTSTAT clear, or EXTSR media bits zero), the branch at
jmphy.c:124-127 prints "no media present" and **skips mii_phy_add_media()**,
then jmphy.c:131 calls MIIBUS_MEDIAINIT → miibus_mediainit (mii.c:228-246)
walks an EMPTY ifm_list, `media` stays 0, and mii.c:244 calls
ifmedia_set(&mii->mii_media, 0) → sys/net/if_media.c:168-175:
ifmedia_match() on an empty list returns NULL → panic("ifmedia_set").

Realistic trigger: a JMicron JMP211/JMP202 PHY whose ID registers still
match (miidevs: oui JMICRON 0x001b8c, models 0x21/0x22) while BMSR reads
0 — e.g. jme's SMI read timing out returns 0 (if_jme.c:303-308), or a
stuck-reset / partially-powered-down PHY. Not emulatable on QEMU.

## Build / run (on the guest)

    mkdir -p /root/df4981 && cd /root/df4981   # jmsink.c + Makefile there
    sh build.sh                                # -> jmsink.ko
    sh run.sh                                  # kldload; sysctl hw.jmsink_fire=1
                                              # EXPECTED: panic("ifmedia_set"),
                                              # ssh dies, guest down

## Fix-mechanism check (after vm.sh reset with-src)

    kldload /root/df4981/jmsink.ko && sysctl hw.jmsink_fixcheck=1
    # EXPECTED: survives, ifm_cur non-NULL (the IFM_NONE fallback entry that
    # unconditional mii_phy_add_media() installs — mii_physubr.c:235-237)

## Success criterion

Baseline: `panic: ifmedia_set` on the serial console, guest down.
Fixcheck: survives with non-NULL ifm_cur.