# DF-5080 — nsgphy_status() 1000BASE-T decode skips master/slave resolution (MSR) and fault (MSF) checks; master role never reported

File: `sys/dev/netif/mii_layer/nsgphy.c` (pass 2, GLM 5.3)

## What this is

Static-inspection finding (Low). No runtime PoC exists because the trigger
requires a physical National Semiconductor DP83891/DP83861 gigabit PHY,
which the QEMU guest does not have (virtio-net only — see `env.txt`).

## Root cause (path:line)

`nsgphy_status()` reads the 1000BASE-T status register
(`NSGPHY_MII_1000STS`, reg 0x0A) at `nsgphy.c:252` and maps the
**link-partner capability** bits directly to the active media word:

- `nsgphy.c:253-254`  `gstat & NSGPHY_1000STS_LPFD` → `IFM_1000_T | IFM_FDX`
- `nsgphy.c:255-256`  `gstat & NSGPHY_1000STS_LPHD` → `IFM_1000_T | IFM_HDX`

It never consults:

- `NSGPHY_1000STS_MSF` (0x8000, master/slave **fault**) — `nsgphyreg.h:133`
- `NSGPHY_1000STS_MSR` (0x4000, master/slave **resolution result**,
  1 = resolved-as-master) — `nsgphyreg.h:134`

and therefore also never reports `IFM_ETH_MASTER`.

Contrast the sibling `e1000phy_status()`, which gates its decode on a
resolution bit before reporting (`e1000phy.c:478-483`,
`E1000_SSR_SPD_DPLX_RESOLVED`).

## Consequence

After AN-complete (`NSGPHY_BMSR_ACOMP`), in the window where the
master/slave exchange is unresolved — and persistently when it **faulted**
(MSF set, link never comes up at 1000) — the kernel reports
`mii_media_active = 1000baseT-FDX` derived from the partner's advertisement
bits. `mii_phy_statusmsg()` (`mii_physubr.c:451-483`) feeds that into
`ifp->if_baudrate` / link-state announcements and NIC `statchg` callbacks.
Operators, monitoring daemons and devd/netgraph automation keying on link
media/baudrate see a phantom 1000baseT link. No memory-safety impact; no
attacker-controlled corruption; display/monitoring correctness only.

## How to verify statically

1. Read `nsgphy.c:245-269`: the AUTOEN branch decodes LPFD/LPHD with no
   MSR/MSF test anywhere in the function (grep MSF/MSR: only in
   `nsgphyreg.h`).
2. Read `nsgphyreg.h:132-140` for the register layout.
3. Compare `e1000phy.c:478-483`.

## Fix

`fix.diff` in this directory (authored against the read-only tree, never
applied to `sys/`). Gate the 1000T decode on the absence of MSF, surface
`IFM_ETH_MASTER` from MSR, and only report 1000T when the master/slave
result is valid.