# DF-5077 — acphy_attach 'no media present' branch → hub panic("ifmedia_set") at attach

**File:** `sys/dev/netif/mii_layer/acphy.c:169-172` (6th leaf of the DF-4930 /
DF-4957 / DF-4981 / DF-5003 / DF-5053 empty-media family; hub = DF-5001)

## Build (on the guest)

```
mkdir -p /root/df5077 && cp miihub.c Makefile build.sh run.sh /root/df5077/
sh /root/df5077/build.sh        # make -m /usr/share/mk -> miihub.ko (rc=0)
```

## Run (on the guest)

```
sh /root/df5077/run.sh
```

1. `hw.miihub_fixcheck=1` — the FIXED hub walk (empty list → add
   `IFM_ETHER|IFM_AUTO` → `ifmedia_set`) must survive with `ifm_cur != NULL`.
2. `hw.miihub_fire=1` — the VERBATIM `miibus_mediainit` walk (mii.c:238-244)
   on the EMPTY media list — exactly the state produced when acphy_attach
   takes its `'no media present'` branch.

## Expected

* fixcheck: survives, prints `ifm_cur=0xfffff8...` (non-NULL), rc=0.
* fire: `ifmedia_set: no match for 0x0/0xfffffff` then
  **`panic: ifmedia_set`** — trace `ifmedia_set <- miihub_fire <- sysctl`;
  guest goes down into DDB (`panic.txt`).

## Trigger precondition (why end-to-end is `not_reproduced`)

Firing the leaf itself requires an Altima AC101/AC101L-family PHY whose ID
registers match `acphys[]` (acphy.c:107-113) while its BMSR reports ZERO
media capability at attach time (faulty PHY, or `mii_capmask` masking the
media bits). PHY register behavior is not emulatable in the QEMU guest —
same class as the family leaves (DF-4930 verdict). The kernel-side sink of
the chain is nonetheless proven fresh on this guest (panic.txt), and the
family-wide fix (DF-5001 hub guard) is build-validated (fix_build.log,
miibus.ko rc=0, 0 errors/0 warnings) and behavior-validated (fixcheck).