# DF-5179 — Verification Verdict

**Status:** untested (source-confirmed; boot-config-gated — no unprivileged
or guest-runnable trigger exists)
**Impact:** panic (boot-time kernel panic when triggered)
**Confidence:** certain
**Attempts:** 0 (no runtime attempt — see below)

## Why the code path is proven without a guest run

Every link in the chain is visible in the tree:

1. `atkbdattach()` passes the parent ivar `irq` to
   `bus_alloc_legacy_irq_resource()` and forwards the unchecked result to
   `BUS_SETUP_INTR()` — `sys/dev/misc/atkbd/atkbd_isa.c:119-122`.
2. With no `hint.atkbd.N.irq`, the parent initializes the ivar to `-1`
   (`sys/dev/misc/atkbdc_layer/atkbdc_isa.c:221-224`), which becomes
   `(u_long)-1` in `BUS_ALLOC_RESOURCE(..., start=ULONG_MAX, end=ULONG_MAX,
   ...)` (`sys/kern/subr_bus.c:3303-3310`) — an ISA IRQ rman range that can
   never be satisfied → returns NULL.
3. `BUS_SETUP_INTR` walks atkbdc (bus_generic) → isa
   (`sys/bus/isa/x86_64/isa.c:143-149`) → nexus, and
   `nexus_setup_intr()` executes `panic("%s: NULL irq resource!", __func__)`
   on the NULL resource — `sys/platform/pc64/x86_64/nexus.c:505-506`.
4. Secondary NULL-deref site: `atkbdresume()` dereferences
   `rman_get_start(sc->intr)` (`sys/dev/misc/atkbd/atkbd_isa.c:141`).
5. Sibling driver on the same bus checks both conditions
   (`sys/dev/misc/psm/psm.c:2014-2022`) — atkbd_isa.c is the outlier.

## Why no guest run

The trigger is boot-time and requires either a kernel config/loader hint
without `irq 1` (root-only file edits + reboot, risking an unbootable
console-less guest) or ISA IRQ rman exhaustion. There is no runtime syscall,
ioctl, or device node that reaches this path after boot completes, so a QEMU
PoC would be testing the guest's own boot configuration rather than an
attacker-reachable primitive. Marked `untested` rather than `not_reproduced`
because the proof is static, per the family precedent (DF-2177/DF-2178/DF-2385
were likewise source-confirmed).

## Fix validation

`fix.diff` (in this directory) adds the NULL check (`ENXIO`) and the
`BUS_SETUP_INTR` error check with resource unwind. Verified to apply cleanly
(`patch -p1 --dry-run` OK against a pristine copy of the file). Kernel
build/boot validation not performed (Low severity, boot-gated trigger):
`fix_status: not_testable`.

## Source File

`sys/dev/misc/atkbd/atkbd_isa.c`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.