# DF-5053 — qsphy_attach 'no media present' branch → panic("ifmedia_set") at attach (5th leaf of the DF-4930 family)

## What

`qsphy_attach()` (`sys/dev/netif/mii_layer/qsphy.c:166-174`) reads BMSR
once, after `qsphy_reset(sc)` (qsphy.c:162 → `mii_phy_reset` writes
BMCR_RESET, mii_physubr.c:191); if the media capability bits are clear it
prints "no media present" (qsphy.c:171) and **skips
`mii_phy_add_media()`**, then still calls `MIIBUS_MEDIAINIT` (qsphy.c:174)
→ `miibus_mediainit()` (`mii.c:227-245`) walks an EMPTY `ifm_list` and
terminates in `ifmedia_set(&mii->mii_media, 0)` (mii.c:244) → DragonFly
`panic("ifmedia_set")` (`sys/net/if_media.c`). Family: atphy DF-4930,
ciphy DF-4957, jmphy DF-4981, truephy DF-5003; hub fix belongs to
DF-5001. Note `mii_phy_add_media`'s own IFM_NONE fallback is unavailable
here — it is gated on `MIIF_NOISOLATE` being clear (mii_physubr.c:230)
and qsphy always sets `MIIF_NOISOLATE` (qsphy.c:160).

## Reproduce (on the QEMU guest)

```
# build (guest):  sh build.sh      # make SYSDIR=/usr/src/sys -> qsmedia.ko
# baseline run:   sh run.sh        # kldload -> panic; grab vm.sh log
# fixcheck:       sh run_fix.sh    # (after reset) mechanism replay
# patched kernel: apply fix.diff, make nativekernel+installkernel,
#                 reboot, kldload again -> no panic (run.3.log)
```

`qsmedia.ko` is a synthetic MII MAC controller presenting a QS6612
(PHYIDR1=0x0181 PHYIDR2=0x4401 → OUI 0x006051/model 0, miidevs:66,241)
whose BMSR loses its media bits across the reset the driver itself
issues — the faulty/flaky-PHY precondition. The REAL qsphy driver probes
and attaches on the synthetic bus.

## Expected output

Baseline (serial console, panic.txt / run.log):
```
qsmedia0: <synthetic single-PHY MII controller (DF-5053)> on motherboard
qsmedia: probing MII bus (QS6612 id1=0x0181 id2=0x4401, pre-reset BMSR=0x7808)
miibus0: <MII bus> on qsmedia0
qsphy0: <QS6612 10/100 media interface> on miibus0
qsphy0:  no media present
ifmedia_set: no match for 0x0/0xfffffff
panic: ifmedia_set
Trace: ifmedia_set() <- qsphy_attach() <- device_doattach() <- bus_generic_attach() <- miibus_attach()
```

Patched kernel (run.3.log): same kldload, `qsphy0:  no media present`,
attach completes, NO panic, clean kldunload.

## Severity rationale

Low: attach/boot-time kernel DoS requiring a PHY that answers the ID
probe but reports no media capabilities after reset (faulty hardware or
MDIO-in-the-loop). No unprivileged userland path drives the bus into
this state. The sink itself is proven on the stock kernel with a real
qsphy driver in the backtrace.