# DF-5001 — miibus_mediainit panics on an empty media list (the hub of the
DF-4930 / DF-4957 / DF-4981 "no media present" family)

## What

`miibus_mediainit()` (`sys/dev/netif/mii_layer/mii.c:227-245`) pokes the
parent NIC for its own media, then walks `mii->mii_media.ifm_list` looking
for `IFM_ETHER|IFM_AUTO`, and unconditionally calls
`ifmedia_set(&mii->mii_media, media)` (mii.c:244). If the list is EMPTY
(every probed PHY took its "no media present" branch and the parent added
nothing), the walk body never runs, `media` stays `0` (mii.c:232), and
`ifmedia_set(ifm, 0)` finds no match and executes
`panic("ifmedia_set")` (`sys/net/if_media.c:174`). DragonFly panics where a
graceful attach failure is warranted.

## Reproduce (on the QEMU guest)

```
# build (guest):      sh build.sh        # or: see build.log
# baseline run:       sh run.sh          # expect panic + guest down
# after vm.sh reset:  sh run_fix.sh      # fixed walk must survive
```

The KLD `miihub.ko` replays the hub walk verbatim (mii.c:238-244) against a
real `struct ifmedia` with an empty list:

- `sysctl hw.miihub_fire=1` — baseline: `ifmedia_set: no match for 0x0/...`
  then `panic: ifmedia_set` (see panic.txt).
- `sysctl hw.miihub_fixcheck=1` — the fixed walk (fix.diff): survives,
  `ifm_cur` non-NULL (see run.2.log).

## Expected output

Baseline (serial console, panic.txt):
```
miihub: ifmedia_init (EMPTY ifm_list -- ...)
miihub: running miibus_mediainit walk verbatim (mii.c:238-244)
ifmedia_set: no match for 0x0/0xfffffff
panic: ifmedia_set
Trace: ifmedia_set() <- miihub_fire() <- sysctl_root <- userland_sysctl <- sys___sysctl
```

Fixcheck (run.2.log):
```
miihub-fix: survived; ifm_cur=0xfffff8008d481d60 media=0x20
miihub-fix: ifm_cur->ifm_media=0x20 (service deref safe)
```

## Trigger precondition (why this is Low, not High)

The empty list requires real PHY hardware whose BMSR/EXTSR report zero
media capability while still answering the probe (the DF-4930 atphy,
DF-4957 ciphy, DF-4981 jmphy, DF-5003 truephy attach branches — plus the
~20 `ukphy_attach`-shaped siblings), behind a parent NIC whose mediainit
method adds no media of its own. No unprivileged userland path can drive
the bus into this state; it is an attach/boot-time DoS on faulty or
malicious hardware-in-the-loop. The sink itself (the hub walk + terminal
`ifmedia_set`) is proven on this kernel by the replay above.