# DF-5031 — it.c: missing signed conversion of IT87xx temperature registers

**File:** `sys/dev/powermng/it/it.c`
**Severity:** Info (sensor-data correctness; no memory-safety impact)
**Confidence:** certain (code inspection; chip semantics from IT87xx datasheet family)

## What the code does

```c
void
it_generic_stemp(struct it_softc *sc, struct ksensor *sensors)
{
	int i, sdata;

	for (i = 0; i < 3; i++) {
		sdata = it_readreg(sc, ITD_SENSORTEMPBASE + i);   /* u_int8_t */
		/* Convert temperature to Fahrenheit degres */
		sensors[i].value = sdata * 1000000 + 273150000;   /* it.c:261 */
	}
}
```

`it_readreg()` returns `u_int8_t` (it.c:192-197), so `sdata` is 0..255.
IT87xx temperature data registers (0x29-0x2B here) are **signed two's
complement degrees Celsius**. The formula `degC * 1e6 + 273150000` is the
correct µK conversion used across the DragonFly hw.sensors framework, but
without an `(int8_t)` cast every sub-zero reading (0x80..0xFF = -128..-1 °C)
is reported as **+128 .. +255 °C** (up to ~528 K) under
`hw.sensors.it0.tempN`. The stale comment also says "Fahrenheit" — the
framework unit is micro-Kelvin.

## Impact

Wrong monitoring data only. An overheating-vs-frozen misread is an
operational hazard (a chilled sensor reads as scorching), but there is no
memory-safety, privilege, or DoS consequence: `sensors[i].value` is
`int64_t` (sys/sys/sensors.h:146) and the arithmetic stays far below
overflow even with the sign bug (255e6 + 273.15e6 ≈ 5.3e8 < 2^63).

## Why it is only Info

The driver requires two admin gates before it exists at runtime:
`sys/conf/files:2601` gates it behind `optional it isa` (not in
X86_64_GENERIC — guest-verified 0 matches; no `it.ko` shipped or loaded),
and the ISA device needs an explicit port hint before probe/attach run. Once
attached, the parsed data comes from the monitored chip's own registers, not
from any unprivileged user input; unprivileged users can only *read* the
resulting sysctl values.

## Reproduce (reachability, read-only)

`reachability.sh` / `reachability.log` — on the QEMU guest: `device it`
absent from the config, no it.ko, not loaded. No runtime PoC possible
(no IT87xx hardware behind QEMU).

## Recommended fix

```diff
--- a/sys/dev/powermng/it/it.c
+++ b/sys/dev/powermng/it/it.c
@@ -258,7 +258,8 @@ it_generic_stemp(struct it_softc *sc, struct ksensor *sensors)
 	int i, sdata;
 
 	for (i = 0; i < 3; i++) {
-		sdata = it_readreg(sc, ITD_SENSORTEMPBASE + i);
-		/* Convert temperature to Fahrenheit degres */
+		/* temp registers are signed two's complement, degC */
+		sdata = (int8_t)it_readreg(sc, ITD_SENSORTEMPBASE + i);
+		/* Convert temperature to micro-Kelvin */
 		sensors[i].value = sdata * 1000000 + 273150000;
 	}
 }
```

(Full context in `fix.diff`; never applied to `sys/`.)