# DF-5003 VERDICT — NOT REPRODUCED end-to-end (hardware precondition);
code path certain; sink proven live by the DF-5001 hub replay

**Bottom line:** `truephy_attach()`'s "no media present" branch
(truephy.c:171-175) adds no media entry, yet attach still terminates in
`MIIBUS_MEDIAINIT(sc->mii_dev)` (truephy.c:178) → `miibus_mediainit()`
(mii.c:227-245) → `ifmedia_set(&mii->mii_media, 0)` (mii.c:244) →
`panic("ifmedia_set")` (sys/net/if_media.c:174). This is the fourth
instance of the DF-4930/DF-4957/DF-4981 family, and the sink itself has
now been executed live on this exact kernel by the DF-5001 hub replay
(../DF-5001/panic.txt: `ifmedia_set: no match for 0x0/0xfffffff` →
`panic: ifmedia_set`, trace `ifmedia_set<-miihub_fire<-sysctl`, guest
down; the fixed walk survives in ../DF-5001/run.2.log).

## Why not_reproduced (consistent with the family)

Entering the branch requires an Agere ET1011/ET1011C PHY whose ID
registers match the truephy table (truephy.c:69-73) while BMSR reports
`BMSR_MEDIAMASK == 0` and EXTSR `EXTSR_MEDIAMASK == 0` — a faulty or
malicious PHY-in-the-loop. The QEMU guest has no such PHY and MDIO
register behavior is not emulatable, so the end-to-end chain cannot run
here (identical classification to DF-4930/DF-4957/DF-4981: Low,
hardware-fault precondition, attach-time DoS, no unprivileged trigger).

## Pass-2 deltas vs. the sibling findings

1. **The DF-4930 leaf-fix pattern is a no-op for this driver.**
   truephy.c:157 sets `MIIF_NOISOLATE` before the media branch, and
   `mii_phy_add_media()`'s IFM_NONE fallback is gated on MIIF_NOISOLATE
   being clear (mii_physubr.c:230-232) — an unconditional
   `mii_phy_add_media()` would still add zero entries and the panic
   would remain. The correct fixes are the hub guard (DF-5001, primary)
   or an explicit `ifmedia_add` (this pack's fix.diff, mirroring
   DF-4957's ciphy fix which had the same constraint).
2. **Multiphy ordering note:** with several PHYs on the bus, the FIRST
   attaching PHY drives `miibus_mediainit` (each PHY attach ends in
   MIIBUS_MEDIAINIT); a zero-cap truephy first in the list panics before
   later PHYs can add media — the hub guard also fixes that ordering
   window.

## Fix

`fix.diff` — explicit `ifmedia_add(&mii->mii_media,
IFM_MAKEWORD(IFM_ETHER, IFM_NONE, 0, sc->mii_inst), MII_MEDIA_NONE,
NULL)` inside the no-media branch. Applies cleanly
(`git apply --check` OK); the patched truephy.c compiles clean under the
kernel's full `-Werror` set as a KLD source on the guest
(fixcheck-build.log). The **DF-5001 hub fix is the recommended family
fix** and covers this driver without any truephy change.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.