# DF-5203 — ipmi_smbus_probe lacks the `ipmi_attached` singleton guard (DF-5076 family, 2nd instance)

- **File:** `sys/dev/misc/ipmi/ipmi_smbus.c:65-71`
- **Severity:** Low (hardware/firmware-gated double attach; DoS-class ceiling)
- **Bucket:** base:dev
- **Confidence:** certain (guard absence is a static code fact; matrix in `guard_matrix.log`)

## Build / run (reproduce the static proof — no runtime PoC exists)

```sh
# guard matrix across all four IPMI frontends:
grep -n ipmi_attached sys/dev/misc/ipmi/ipmi_pci.c sys/dev/misc/ipmi/ipmi_isa.c \
                       sys/dev/misc/ipmi/ipmi_acpi.c sys/dev/misc/ipmi/ipmi.c
#   -> ipmi_pci.c:77, ipmi_isa.c:85, ipmi_acpi.c:62  (guards)
grep -c ipmi_attached sys/dev/misc/ipmi/ipmi_smbus.c
#   -> 0                                            (missing guard)

# fix validation (against pristine tree; NEVER applied):
git apply --check findings/poc/DF-5203/fix.diff   # passes
```

## Expected

- Guard present in 3 sibling probes, absent in `ipmi_smbus_probe` (and in the
  separately-filed `ipmi2_pci_probe`, DF-5076).
- On firmware with SMBIOS type-38 = SSIF and ≥2 smbus buses, two `ipmi` devices
  attach: second kthread (`ssif_loop`), second `/dev/ipmiN`, two watchdog callouts
  arming the same BMC watchdog, interleaved multi-part SMBus block transactions to
  one BMC address.

## Artifacts

- `guard_matrix.log` — the decisive static proof (grep matrix + consequence chain)
- `env.txt` — guest runtime evidence: no smbus bus, no SMBIOS type-38, live
  `kldload ipmi` demo showing identify is a no-op without the firmware record
- `fix.diff` — adds the sibling guard to `ipmi_smbus_probe` (git apply --check OK)
- `VERDICT.md`, `manifest.json`, `verdict.json`