# trigger.txt — DF-5179 privileged boot-time trigger (documentation only)

The panic requires the atkbd device to attach WITHOUT a valid ISA IRQ.
Two privileged routes:

(1) Missing IRQ hint (defaults to -1): add to /boot/loader.conf (root):

    hint.atkbd.0.at="atkbdc"
    # note: no hint.atkbd.0.irq line at all, and a kernel config
    # without "device atkbd0 at atkbdc? irq 1"

  atkbdc_add_device() then sets kdev->irq = -1
  (sys/dev/misc/atkbdc_layer/atkbdc_isa.c:221-224), atkbdattach()
  calls bus_alloc_legacy_irq_resource(dev, &rid, (u_long)-1, RF_ACTIVE)
  (sys/dev/misc/atkbd/atkbd_isa.c:120), the ISA IRQ rman fails the
  [ULONG_MAX,ULONG_MAX] range, returns NULL, and BUS_SETUP_INTR()
  forwards NULL down to nexus_setup_intr() which executes:

      panic("nexus_setup_intr: NULL irq resource!")

  (sys/platform/pc64/x86_64/nexus.c:505-506)

(2) IRQ rman exhaustion/conflict: configure two ISA devices onto the same
    irq such that the second (non-shareable) allocation fails while the
    keyboard is being attached.

Not runnable on the shared audit guest: route (1) requires editing the
guest's loader.conf/kernel config and rebooting into a possibly unbootable
system (the keyboard is the console); both routes are root-only privileged
configuration, so no unprivileged runtime PoC exists.