{
  "finding_id": "DF-5090",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static-verification pass-2 audit of sys/dev/netif/mii_layer/ruephy.c: the driver is dead code. Its probe (ruephy.c:96) only accepts children of a NIC named \"rue\", and an exhaustive search of sys/ (proof.sh, all invariants green) shows no DRIVER_MODULE/driver_t/config/module/if_rue source named \"rue\" exists in this tree \u2014 sys/bus/u4b/net/ even holds a never-compiled FreeBSD ruephy.c orphan, confirming the RTL8150 NIC driver was never ported. The audited copy IS compiled into miibus (conf/files:1094) and registers a driver that probes every MII child and always returns ENXIO. Consequently the three latent family defects it carries \u2014 the DF-4930/DF-5001 empty-media attach-panic branch (ruephy.c:141-145), the DF-1973/DF-5009 service-entry KASSERT (ruephy.c:161, live on stock kernels since X86_64_GENERIC:56 enables INVARIANTS), and the unguarded ifm_cur deref (ruephy.c:282) \u2014 are unreachable on every kernel buildable from this tree. No runtime PoC is constructible (the required parent driver does not exist), so no guest run was performed; the tree/build-system proof is stronger than any single-guest observation. Impact today: none; the risk materializes only if rue(4) is ever ported without the DF-5001 hub guard.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5090/proof.log sections A-G: A shows the only \"rue\" literals in sys/ are the two ruephy probe gates themselves (mii_layer ruephy.c:96, u4b orphan ruephy.c:101); B/C no device rue config and no if_rue/rue.c source; D u4b orphan referenced by no build file; E audited copy compiled via sys/conf/files:1094; F the three latent family patterns quoted from ruephy.c:141-145/161-162/282; G INVARIANTS enabled in stock X86_64_GENERIC (config line 56) so the KASSERT would be live if reachable.",
  "kernel_refs": [
    "sys/dev/netif/mii_layer/ruephy.c:96",
    "sys/dev/netif/mii_layer/ruephy.c:121",
    "sys/dev/netif/mii_layer/ruephy.c:134",
    "sys/dev/netif/mii_layer/ruephy.c:141",
    "sys/dev/netif/mii_layer/ruephy.c:161",
    "sys/dev/netif/mii_layer/ruephy.c:282",
    "sys/bus/u4b/net/ruephy.c:101",
    "sys/conf/files:1094",
    "sys/config/X86_64_GENERIC:56",
    "sys/sys/systm.h:94",
    "sys/dev/netif/mii_layer/mii.c:228",
    "sys/kern/subr_bus.c:2108"
  ],
  "poc_changes": "Original evidence pack; no seed PoC existed. proof.sh was written fresh and iterated once (section G corrected: DragonFly stock X86_64_GENERIC DOES enable INVARIANTS \u2014 initial FreeBSD-centric annotation was wrong).",
  "attempts": 0,
  "guest_uname": "(none \u2014 static verification only; QEMU not booted, Phase V exempt for Info hardening finding)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "sh findings/poc/DF-5090/proof.sh  (from repo root; host-side static proof)",
  "run_cmd": "sh findings/poc/DF-5090/proof.sh  (exit 0, final line PROOF OK: probe gate (ruephy.c:96) can never pass => attach/service/status/reset are unreachable on every kernel buildable from this tree.)",
  "code_hash": "12597a0b22d8d4923013a3905adabfb04287aff2134ba91c7ed2fc79266f5b5c",
  "notes": "Pass-2 audit of the file with the mii family checklist: (a) empty-media branch present at 141-145 \u2014 unreachable; (b) service KASSERT present at 161 \u2014 DF-1973/DF-5009 family, live under INVARIANTS (stock configs enable it) but doubly defused (probe gate + instance!=0 refusal at 121-124); (c) status decode sound except the shared upstream unguarded ifm_cur deref at 282 (NULL only via the empty-media path that panics earlier); (d) reset bounded via mii_physubr.c:183; (e) probe sentinel depends entirely on the parent-name gate; (f) reachability: NONE \u2014 no rue(4) in DragonFly (u4b/net has an orphaned uncompiled ruephy pair as the smoking gun). Sibling leaf records: DF-4930/4957/4981/5003/5053; hubs DF-5001 (empty-media) and DF-1973/DF-5009 (service assert).",
  "recommended_fix": "Retire sys/dev/netif/mii_layer/ruephy.c (+ ruephyreg.h) and the never-compiled sys/bus/u4b/net/{ruephy.c,ruephyreg.h} orphans; if rue(4) is ever ported, land the DF-5001 miibus_mediainit guard in the same commit.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Not applicable: the finding is dead code whose remedy is deletion (or deferring to the DF-5001 family hub fix if rue(4) is ever ported). There is no baseline behavior to reproduce and no patch whose behavior change could be validated on the guest.",
  "fix_evidence": "findings/poc/DF-5090/proof.log sections A-E establish that no rue parent driver exists, so no baseline or patched runtime behavior exists to compare."
}