{
  "finding_id": "DF-5103",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "apple_fw registers hundreds of world-readable sysctl oids pointing directly into its ~330KB softc (apple_fw_sysctl.c:32-126 via apple_fw.c:144) but apple_fw_detach (apple_fw.c:149-156) tears down nothing. Newbus device_detach frees the softc via device_set_driver (subr_bus.c:1941-1947) BEFORE device_sysctl_fini unregisters the oids (subr_bus.c:2151), and readers run handlers under only a shared sysctl lock (kern_sysctl.c:1572-1576) that the freeing path does not take in between \u2014 so a racing unprivileged sysctl read during a root-initiated unload executes string/opaque/int handlers against freed, possibly reused heap. Mechanism is source-certain; the race window is microscopic and root-cooperated, hence Low severity and no guest reproduction attempted (contract exempts Low findings).",
  "exploit_chain": "theorized: (1) unprivileged process spins on sysctl dev.apple_fw.0.dsm.* reads; (2) root kldunloads apple_fw; (3) a read landing between subr_bus.c:1944 (kfree softc) and :2151 (sysctl_ctx_free) strlen/copies freed heap to userspace \u2014 leak of reused slab contents. Not demonstrated.",
  "evidence": "VERDICT.md traces the window statement-by-statement: apple_fw.c:144,149-156; apple_fw_sysctl.c:28-126; subr_bus.c:2130-2154, 1941-1947, 234-240; kern_sysctl.c:70-76, 1572-1576. No runtime artifacts (untested).",
  "kernel_refs": [
    "sys/dev/apple/fw/apple_fw.c:144",
    "sys/dev/apple/fw/apple_fw.c:149",
    "sys/dev/apple/fw/apple_fw_sysctl.c:28",
    "sys/kern/subr_bus.c:1944",
    "sys/kern/subr_bus.c:2151",
    "sys/kern/kern_sysctl.c:1573"
  ],
  "poc_changes": "No PoC written: exploitation needs a root-initiated unload racing an unprivileged reader inside a microsecond window; classified Low and exempt from mandatory verification.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Family precedent: DF-4773 (apple_smc, Medium, wider window). The ordering flaw itself is generic newbus (every driver using the device sysctl ctx with softc-backed oids); filed here against apple_fw as the audited instance with the largest softc exposure (~330KB via 64 dsm devices). Guest was used this run only for DF-5102 and was returned clean via vm.sh reset with-src.",
  "recommended_fix": "Free a driver-owned sysctl ctx inside apple_fw_detach before newbus frees the softc (fix.diff); kernel-wide hardening: call device_sysctl_fini before device_set_driver in device_detach.",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No baseline or patched run performed (finding untested \u2014 Low severity race). fix.diff is a source-level driver fix authored from the traced teardown sequence: driver-owned ctx freed in detach guarantees the oids are unregistered before the softc is kfreed by device_set_driver.",
  "fix_evidence": "VERDICT.md source trace; fix.diff."
}