{
  "finding_id": "DF-5053",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "root_cause": "qsphy_attach reads BMSR after qsphy_reset (qsphy.c:166 after :162) and, when no media capability bits survive, takes the 'no media present' branch (qsphy.c:168-171) WITHOUT adding any ifmedia entry, then calls MIIBUS_MEDIAINIT (qsphy.c:174) -> miibus_mediainit (mii.c:227-245) walks an EMPTY ifm_list and terminates in ifmedia_set(&mii->mii_media, 0) (mii.c:244) -> panic(\"ifmedia_set\") — 5th leaf of the DF-4930/DF-4957/DF-4981/DF-5003 family, hub DF-5001; mii_phy_add_media's own IFM_NONE fallback is unavailable because qsphy always sets MIIF_NOISOLATE (qsphy.c:160 vs mii_physubr.c:230)",
  "kernel_refs": [
    "sys/dev/netif/mii_layer/qsphy.c:160",
    "sys/dev/netif/mii_layer/qsphy.c:162",
    "sys/dev/netif/mii_layer/qsphy.c:166",
    "sys/dev/netif/mii_layer/qsphy.c:168",
    "sys/dev/netif/mii_layer/qsphy.c:171",
    "sys/dev/netif/mii_layer/qsphy.c:174",
    "sys/dev/netif/mii_layer/mii.c:227",
    "sys/dev/netif/mii_layer/mii.c:244",
    "sys/dev/netif/mii_layer/mii.c:105",
    "sys/dev/netif/mii_layer/miivar.h:138",
    "sys/dev/netif/mii_layer/mii.h:109"
  ],
  "reproduce": {
    "build": "sh build.sh   # make SYSDIR=/usr/src/sys -> qsmedia.ko on the audit guest",
    "run": "sh run.sh     # kldload -> real qsphy attach panics; then run_fix.sh after reset; then kernel-rebuild validation",
    "expected": "baseline: qsphy0 'no media present' -> 'ifmedia_set: no match for 0x0/0xfffffff' -> panic: ifmedia_set, backtrace ifmedia_set <- qsphy_attach <- bus_generic_attach <- miibus_attach (panic.txt/run.log). fixcheck mechanism: survives, ifm_cur non-NULL (run.2.log). patched kernel (fix.diff, nativekernel -Werror, installkernel, reboot): same kldload completes with NO panic, clean kldunload (run.3.log)."
  },
  "artifacts": [
    "README.md", "VERDICT.md", "qsmedia.c", "Makefile",
    "build.sh", "run.sh", "run_fix.sh",
    "build.log", "run.log", "run.2.log", "run.3.log",
    "panic.txt", "kernel_build.log", "env.txt",
    "fix.diff", "manifest.json", "verdict.json"
  ]
}