{
  "finding_id": "DF-5155",
  "title": "perfbias: raw wrmsr/rdmsr(MSR_IA32_ENERGY_PERF_BIAS=0x1b0) in the cpuhelper path panics the compiled-in driver on CPUID-lying platforms (DF-4735 class), root-gated",
  "verdict": "reproduced (consequence): the exact perfbias.c:178 wrmsr(0x1b0) in kernel context -> Fatal trap 9 GPF -> DDB, guest down, on the -cpu host KVM guest whose MSR 0x1b0 provably faults (safe accessors -> error 14) while its CPUID ECX gate is masked; fix build-validated, patched kernel booted, graceful path demonstrated live",
  "impact": "panic (privileged local DoS: sysctl write / driver detach; no unprivileged surface)",
  "reproduce": {
    "build": "mkdir -p /tmp/pbmod && cp pbtest.c /tmp/pbmod/ && cd /tmp/pbmod && printf 'KMOD=\\tpbtest\\nSRCS=\\tpbtest.c\\n\\n.include <bsd.kmod.mk>\\n' > Makefile && make SYSDIR=/usr/src/sys",
    "run": "kldload /tmp/pbmod/pbtest.ko   (on a CPU/VMM where MSR 0x1b0 faults, e.g. this KVM guest booted with QEMU_EXTRA='-cpu host')",
    "expected": "rdmsr_safe -> error 14; wrmsr_safe -> error 14; then 'Fatal trap 9: general protection fault while in kernel mode' / 'Stopped at pbtest_modevent+0xad: wrmsr' / DDB / guest down"
  },
  "kernel_refs": [
    "sys/dev/powermng/perfbias/perfbias.c:178",
    "sys/dev/powermng/perfbias/perfbias.c:179",
    "sys/dev/powermng/perfbias/perfbias.c:99",
    "sys/dev/powermng/perfbias/perfbias.c:103",
    "sys/dev/powermng/perfbias/perfbias.c:152",
    "sys/dev/powermng/perfbias/perfbias.c:166",
    "sys/kern/kern_sysctl.c:1446",
    "sys/config/X86_64_GENERIC:173"
  ],
  "artifacts": ["README.md", "VERDICT.md", "pbtest.c", "pbfix.c", "build.sh", "run.sh", "build.log", "run.log", "run.2.log", "panic.txt", "env.txt", "fix.diff", "fix_build.log", "manifest.json", "verdict.json"]
}