{
  "finding_id": "DF-5076",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Pass-2 audit of the IPMI PCI glue. The driver enforces a singleton invariant via the global ipmi_attached (ipmi.c:65, set to 1 on every successful ipmi_attach at ipmi.c:864), and all three sibling frontend probes honor it -- ipmi_pci_probe (Dell 1028:000d quirk, ipmi_pci.c:77), ipmi_isa_probe (ipmi_isa.c:85), ipmi_acpi_probe (ipmi_acpi.c:62). The native-PCI frontend ipmi2_pci_probe (ipmi_pci.c:183-193) does NOT: it matches any class-0c:07 PCI function regardless of a prior attach. On boards whose BMC is described both by a legacy frontend (SMBIOS/ISA, ACPI, or the Dell quirk) and as a native PCI IPMI function -- the exact topology the sibling guards were added for -- newbus attaches the native function after the first attach: ipmi2_pci_attach (ipmi_pci.c:196-275) maps BAR(0), runs the KCS/SMIC setup, and calls ipmi_attach again (ipmi_pci.c:267), producing a second config hook, a second /dev/ipmiN cdev (ipmi.c:831) and a second kthread (ipmi_kcs.c:476 / ipmi_smic.c:382). When both descriptions point at the same BMC (the historical Dell PE2650 case), two state machines interleave transactions on one KCS/SMIC interface; combined with the drivers known unbounded polling loops (DF-1865/DF-1866/DF-2003) the realistic ceiling is a wedged, CPU-pinning kernel thread -- DoS-class, not memory corruption. FreeBSD HEAD inherits the identical omission (verified against upstream sys/dev/ipmi/ipmi_pci.c), so the fix applies to both projects. Severity Low: hardware-topology-gated (needs dual-description BMC hardware), impact hang/DoS. Untestable on this guest: QEMU has no PCI IPMI device model and the guest exposes no class-0c:07 function (env.txt); the current guest boot does not even attach ipmi. Static proof in guard_matrix.log; fix.diff adds the sibling guard, git apply --check verified, never applied to sys/. Negative results (VERDICT.md section 4): the iftype/progif dispatches fully partition (no uninitialized error path), both bad: unwinds are complete and single-shot (kcs/smic attach allocate nothing; ipmi_attach fails before cdev/kthread creation), detach glue is the shared guarded ipmi_detach, BAR handling has no kernel-memory exposure, and the SMBIOS offset->spacing decode is proper ({1,2,4}, ipmi_smbios.c:112-118). The early-boot detach-vs-config_intrhook window is an ipmi.c lifetime issue (noted for the next ipmi.c pass, practically unreachable).",
  "exploit_chain": "",
  "evidence": "guard_matrix.log (guard present at ipmi_pci.c:77 / ipmi_isa.c:85 / ipmi_acpi.c:62, absent in ipmi2_pci_probe ipmi_pci.c:183-193); VERDICT.md section 2 (double-attach chain: ipmi_pci.c:267 -> ipmi.c:864/831 -> ipmi_kcs.c:476); env.txt (guest: no class-0c:07 device, no PCI IPMI model in QEMU); fix.diff (git apply --check passes)",
  "kernel_refs": [
    "sys/dev/misc/ipmi/ipmi_pci.c:183-193",
    "sys/dev/misc/ipmi/ipmi_pci.c:77",
    "sys/dev/misc/ipmi/ipmi_isa.c:85",
    "sys/dev/misc/ipmi/ipmi_acpi.c:62",
    "sys/dev/misc/ipmi/ipmi.c:65",
    "sys/dev/misc/ipmi/ipmi.c:864",
    "sys/dev/misc/ipmi/ipmi.c:831",
    "sys/dev/misc/ipmi/ipmi_pci.c:196-275",
    "sys/dev/misc/ipmi/ipmi_pci.c:267",
    "sys/dev/misc/ipmi/ipmi_kcs.c:476",
    "sys/dev/misc/ipmi/ipmi_smic.c:382",
    "sys/dev/misc/ipmi/ipmi_smbios.c:112-118"
  ],
  "poc_changes": "evidence pack authored fresh in pass 2 (no seed). No runtime PoC exists or is possible: the defect requires a PCI function with class 0x0c subclass 0x07, which the audit guests QEMU cannot provide (no PCI IPMI device model upstream).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "n/a (static code-fact finding; guard_matrix.log is the proof artifact)",
  "run_cmd": "n/a -- QEMU has no PCI IPMI device model; see guard_matrix.log and env.txt",
  "code_hash": "",
  "notes": "pass 2 (GLM 5.3). Known family findings NOT re-reported: DF-1661/DF-4505 (ipmi.c ioctl), DF-1865/DF-1866/DF-1867 (kcs loops), DF-2003/DF-4948/DF-4949 (smic), DF-2024/DF-2025/DF-2026/DF-4978/DF-4979 (ssif), DF-4777 (kcs replylen), DF-2107 (smbios walk). Those loops are what turn this double attach into a wedge. Guest was already up; left clean (read-only env collection only).",
  "recommended_fix": "Add the singleton guard to ipmi2_pci_probe mirroring the siblings: if (ipmi_attached) return (ENXIO); -- see fix.diff (same fix applies to FreeBSD HEAD).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable - requires dual-description BMC hardware (SMBIOS/ACPI/quirk frontend plus a native PCI class-0c:07 function); the audit guest has no such device and QEMU cannot emulate one. fix.diff is git-apply --check verified against the pristine sys/ tree and mirrors the three in-tree sibling guards exactly.",
  "fix_evidence": "findings/poc/DF-5076/fix.diff (git apply --check passes; never applied to sys/)"
}