{
  "finding_id": "DF-5077",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "NOT REPRODUCED end-to-end: the trigger requires an Altima AC101/AC101L-family PHY whose ID registers match acphys[] (acphy.c:107-113) while its BMSR reports zero media capability at attach (hardware fault or mii_capmask masking), and PHY register behavior is not emulatable on the QEMU guest \u2014 the same class as the family leaves (DF-4930 atphy). The kernel-side sink of the chain is nonetheless PROVEN FRESH on this exact guest and kernel: replaying miibus_mediainits walk (mii.c:238-244) on the EMPTY media list \u2014 exactly the state acphy_attachs no media present branch (acphy.c:169-172, aggravated by MIIF_NOISOLATE at acphy.c:161 which also disables the mii_physubr.c:230 IFM_NONE fallback) leaves \u2014 yields ifmedia_set: no match for 0x0/0xfffffff -> panic(\"ifmedia_set\") with trace ifmedia_set<-miihub_fire<-sysctl and kills the guest (panic.txt, captured this run). The fixed hub walk (fix.diff = DF-5001s empty-list guard) survived the identical scenario with ifm_cur non-NULL (service deref safe), and that same fix build-validates: miibus.ko rebuilt rc=0, 0 errors/0 warnings (fix_build.log). 6th leaf of the DF-4930/4957/4981/5003/5053 family; the family-wide fix belongs to hub DF-5001. Attach/boot-time DoS on faulty hardware, no user-controlled trigger, no memory unsafety; severity Low.",
  "exploit_chain": "",
  "evidence": "panic.txt (fresh guest panic + fixcheck transcript: ifmedia_set<-miihub_fire<-sysctl); VERDICT.md (root cause acphy.c:169-172 + mii.c:244 + if_media.c:174); run.log (fixcheck survived, ifm_cur=0xfffff8008d5a10c0); fix_build.log (miibus.ko with hub guard, rc=0, 0/0 diagnostics); fix.diff (DF-5001 hub guard, family fix)",
  "kernel_refs": [
    "sys/dev/netif/mii_layer/acphy.c:169",
    "sys/dev/netif/mii_layer/acphy.c:172",
    "sys/dev/netif/mii_layer/acphy.c:161",
    "sys/dev/netif/mii_layer/acphy.c:175",
    "sys/dev/netif/mii_layer/mii.c:228",
    "sys/dev/netif/mii_layer/mii.c:244",
    "sys/dev/netif/mii_layer/mii_physubr.c:230",
    "sys/net/if_media.c:174"
  ],
  "poc_changes": "miihub.c reused verbatim from DF-5001s pack (it models exactly this leafs state); only the pack scripts/logs are new. Trigger is DF-5001s hw.miihub_fire / hw.miihub_fixcheck pair.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "build_cmd": "sh /root/df5077/build.sh   # make -m /usr/share/mk -> miihub.ko (rc=0)",
  "run_cmd": "sh /root/df5077/run.sh      # kldload; sysctl hw.miihub_fixcheck=1 (survives); sysctl hw.miihub_fire=1 (panics)",
  "code_hash": "c49d24231cc363d3daa1c8ef53d62829b28de8ed9cbda93ba9cfe8870ef44cc6",
  "notes": "Guest panicked as expected by the baseline fire and was reset to the clean with-src snapshot afterwards (guest_dirty=0). Negative results for this file recorded in VERDICT.md: no service KASSERT (DF-1973/DF-5009 family inapplicable \u2014 acphy.c:189-196 uses the standard foreign-instance guard), vendor register indexes all < 0x20 (acphyreg.h), no amphy-DF-2101-style decode transcription error, probe sentinel present, reset waits live in mii_phy_reset (mii_physubr.c:183-213).",
  "recommended_fix": "Family-wide hub guard in miibus_mediainit (mii.c): never call ifmedia_set() on an empty media list \u2014 add IFM_ETHER|IFM_AUTO and set it (fix.diff = DF-5001s, covering every leaf including acphy).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": true,
  "fix_verdict": "Fix validated at behavior + build level on this guest: (a) the fixed hub walk (empty list -> ifmedia_add(IFM_ETHER|IFM_AUTO) -> ifmedia_set) survived the identical empty-list scenario with ifm_cur non-NULL while the verbatim walk panicked the guest (panic.txt); (b) the fix.diff applied clean to guest /usr/src (hunk at :241) and miibus.ko rebuilt rc=0 with 0 errors/0 warnings (fix_build.log); sources reverted md5-verified pristine (2f16a4a6...), make clean. The diff is DF-5001s hub guard \u2014 the family-wide fix that owns this leaf.",
  "fix_evidence": "fix_build.log (miibus.ko rc=0, 0 error:/0 warning:); panic.txt (baseline panic vs fixcheck survival in the same session); fix.diff (the guard hunk)"
}