# DF-5076 evidence pack

## What
`sys/dev/misc/ipmi/ipmi_pci.c` — `ipmi2_pci_probe` (:183-193) is the only
IPMI frontend probe without the `ipmi_attached` singleton guard (siblings:
ipmi_pci.c:77, ipmi_isa.c:85, ipmi_acpi.c:62). On boards whose BMC is
described twice (SMBIOS/ISA/ACPI/Dell-quirk *and* native PCI class 0c:07),
the native PCI function attaches a second full IPMI stack (second cdev,
second kthread at ipmi_kcs.c:476 / ipmi_smic.c:382) after the first frontend
already set `ipmi_attached=1` (ipmi.c:864) — two state machines interleave on
one BMC → KCS/SMIC handshake corruption → stuck kernel threads (compounding
the known unbounded loops DF-1865/DF-1866/DF-2003). FreeBSD HEAD inherits
the same omission.

## Reproduce
Not runnable on this guest: QEMU has no PCI IPMI device model; the guest has
no class-0c:07 PCI function (env.txt). Static proof in `guard_matrix.log`
(grep of all four probes). Verdict: untested / code-fact-certain, following
the DF-4985/DF-5000 precedent for hardware-gated findings.

## Contents
- `VERDICT.md` — narrative, consequence chain, negative results
- `guard_matrix.log` — static guard matrix across the four frontends
- `env.txt` — guest evidence (uname, pciconf: no 0c:07, no AMD GPU, ipmi absent)
- `fix.diff` — add the sibling guard; `git apply --check` verified
- `manifest.json`, `verdict.json`