# DF-5080 — VERDICT

**Status: untested (hardware-gated)** · reproduced: false · impact: none
(security); Low correctness/observability defect.

## Why untested, not false_positive

The code defect is certain by inspection; the runtime trigger is not.
`nsgphy` only attaches to a NatSemi DP83891/DP83861 PHY
(`nsgphy.c:81-85` `MII_PHYDESC(NATSEMI, DP83891/DP83861)`), reached only
via a parent NIC's MII bus on real hardware. The audit guest is
QEMU/i440fx with a virtio NIC (`env.txt` pciconf output: only
`virtio_pci0 0x10001af4` and Intel PIIX `atapci0 0x70108086`); no MII PHY
exists, so `nsgphy` can never attach. Building a "trigger" would prove
nothing about the PHY register semantics that constitute the bug.

## Static proof chain

1. `nsgphy_status()` autoneg branch (`nsgphy.c:245-269`): once
   `NSGPHY_BMCR_AUTOEN` and `NSGPHY_BMSR_ACOMP` hold, it reads
   `NSGPHY_MII_ANLPAR` (reg 5) and `NSGPHY_MII_1000STS` (reg 0x0A).
2. `nsgphy.c:253-256`: `LPFD`/`LPHD` (partner *capability*, per
   `nsgphyreg.h:137-138`) map directly to `IFM_1000_T|IFM_FDX/HDX`.
3. Neither `NSGPHY_1000STS_MSF` (`nsgphyreg.h:133`, master/slave fault)
   nor `NSGPHY_1000STS_MSR` (`nsgphyreg.h:134`, master/slave result,
   1 = master) is referenced anywhere in `nsgphy.c` (verified by grep over
   the file: zero hits).
4. Per DP83891/DP83861 (802.3ab), MS resolution completes as part of
   1000BASE-T autoneg and can **fault**; ACOMP does not imply a resolved,
   healthy 1000 link. e1000phy demonstrates the required shape:
   `e1000phy.c:478-483` refuses to decode until `E1000_SSR_SPD_DPLX_RESOLVED`.
5. Downstream, `mii_phy_statusmsg()` (`mii_physubr.c:465`,
   `ifmedia_baudrate(mii->mii_media_active)`) and
   `mii_phy_update()` → `MIIBUS_STATCHG`/`if_link_state_change()`
   (`mii_physubr.c:486-505`) consume the unvalidated word.

## Impact assessment (honest ceiling)

- ifconfig / routing daemons / monitoring see `1000baseT-FDX` (and a
  1G baudrate) during unresolved windows and, worse, persistently on an
  MS-faulted link that will never carry 1000 traffic.
- Master/slave role is never reported (`IFM_ETH_MASTER` plumbing in the
  mii core exists — cf. DF-1902 — but this driver never sets it).
- No memory safety, no privilege boundary, no remote trigger: severity
  Low; CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N (operator-visible
  integrity only).

## Fix validation

Not applicable: no reproducible runtime on this guest (no PHY), and this
is not a memory-corruption finding, so the mandatory fix-validation cycle
does not attach. `fix.diff` is included and is a straight, compile-checked
shape against the same decode used by e1000phy/brgphy family code.

## Guest hygiene

Guest was up for env capture only (`uname`, `pciconf`); no state changed.
Guest left up (it was up before this run), `guest_dirty = 0`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.