{
  "finding_id": "DF-4981",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "NOT REPRODUCED end-to-end: the trigger requires JMicron JMP211/JMP202 PHY hardware (behind a jme(4) NIC) whose BMSR/EXTSR report zero media capability while its ID registers still match, and no such PHY exists on the QEMU guest (PHY register behavior is not emulatable). The kernel-side sink of the chain is nonetheless PROVEN on this exact kernel: replaying miibus_mediainits terminal ifmedia_set() on an EMPTY media list (what jmphy_attachs no-media branch at jmphy.c:124-129 leads to via mii.c:228-246) yields panic(\"ifmedia_set\") with trace ifmedia_set<-jmsink_fire<-sysctl_root<-userland_sysctl<-sys___sysctl and kills the guest (panic.txt). DragonFlys ifmedia_set panics on no-match where FreeBSD returns. The finding is therefore certain as a code path and likely as a field event (hardware-fault precondition), severity Low (boot/attach-time DoS on jme+JMicron hardware, no user-controlled trigger).",
  "exploit_chain": "",
  "evidence": "panic.txt (sink panic: ifmedia_set: no match for 0x0/0xffffffff -> panic, full trace), run.log (sysctl hw.jmsink_fire=1; ssh never returned; vm.sh status => down), run.2.log (fixcheck after reset: jmsink-fix: survived; ifm_cur=0xfffff8008d481c80), VERDICT.md (jmphy.c:119-131 -> mii.c:228-246 -> sys/net/if_media.c:168-175, parent jme adds no media: if_jme.c:218-220, mii_phy_probe at :1028, SMI timeout returns 0: if_jme.c:303-308)",
  "kernel_refs": [
    "sys/dev/netif/mii_layer/jmphy.c:119-131",
    "sys/dev/netif/mii_layer/mii.c:228-246",
    "sys/dev/netif/mii_layer/mii_physubr.c:221-237",
    "sys/net/if_media.c:168-175",
    "sys/dev/netif/jme/if_jme.c:218-220",
    "sys/dev/netif/jme/if_jme.c:303-308",
    "sys/dev/netif/jme/if_jme.c:1028"
  ],
  "poc_changes": "PoC authored fresh (no seed): jmsink KLD replaying the sink with jmphy-accurate citations; needed device_if.h/bus_if.h copied from the kernel objdir into the module dir for the kmod build.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh   (guest: cp objdir device_if.h/bus_if.h + make -m /usr/share/mk)",
  "run_cmd": "sh run.sh     (guest: kldload jmsink.ko; sysctl hw.jmsink_fire=1)  [+ after reset: sysctl hw.jmsink_fixcheck=1]",
  "code_hash": "6e6ee6e4186165be4faa3caea4b4ecf73b4c6b6f5fbbc94f8d489a9fe375160b",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (jmphy.c: call mii_phy_add_media unconditionally; with zero capabilities it installs the IFM_NONE fallback entry per mii_physubr.c:235-237) could not be exercised end-to-end (no jme/JMicron hardware). Its operative mechanism WAS validated on the guest with the real kernel functions: with the fallback entry present, the identical ifmedia_set sequence survives and leaves ifm_cur non-NULL (run.2.log: jmsink-fix: survived; ifm_cur=0xfffff8008d481c80).",
  "fix_evidence": "VERDICT.md Fix validation section; fix.diff; run.2.log (fixcheck output)",
  "notes": "Instance of the no-media-present family in the mii drivers; precedent DF-4930 (atphy, Low) and DF-4957 (ciphy, Low) named jmphy in their family notes. Same one-line fix shape; alternatively harden mii.cs miibus_mediainit/ifmedia_set for all ~20 siblings at once.",
  "recommended_fix": "jmphy_attach: call mii_phy_add_media() unconditionally so the IFM_NONE fallback entry always exists (see fix.diff); or make miibus_mediainit tolerate an empty media list."
}