# Evidence environment — DF-5203 (ipmi_smbus missing singleton guard)

Collected 2026-10-01 from the audit QEMU/KVM guest (dfbsd-qemu/vm.sh), guest left CLEAN.

## Kernel
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## PCI topology (pciconf -l) — NO SMBus controller present
hostb0@pci0:0:0:0:   class=0x060000 (i440fx)
isab1@pci0:0:1:0:    class=0x060100 (PIIX3 ISA)
atapci0@pci0:0:1:1:  class=0x010180
none0@pci0:0:1:3:    class=0x068000 (PIIX4 PM function — SMBus controller NOT enabled/claimed)
vgapci0@pci0:0:2:0:  class=0x030000
virtio_pci0/virtio_pci1 ...
=> no class 0c:05 device; no ichsmb(4)/iicsmb(4) bus ever attaches; zero smbus parents exist.

## Module state
/boot/kernel/{ipmi,smbus,ichsmb,iicsmb}.ko all present.
kldstat before test: no ipmi module loaded.

## SMBIOS
sysctl machdep.smbios.* : none (no sysctl exposed)
=> QEMU guest firmware provides no SMBIOS type-38 (IPMI) descriptor, in particular
   no SSIF_MODE record, which is the hard precondition for ipmi_smbus_identify()
   to ever create an "ipmi" child (ipmi_smbus.c:60-62).

## Live runtime probe performed (root)
  # kldload ipmi          -> LOADED (module includes ipmi_smbus frontend)
  # ls /dev/ipmi*         -> No such file or directory
  # sysctl dev.ipmi       -> unknown oid  (nothing attached)
  # dmesg | tail          -> no ipmi/ssif messages
  # kldunload ipmi        -> UNLOADED (kldstat grep -c ipmi -> 0)
Interpretation: with ipmi_smbus.c compiled in and its identify/probe/attach methods
registered, the absence of an SMBIOS type-38 SSIF record makes ipmi_smbios_identify()
return 0, so no child is added and no attach occurs. The double-attach topology this
finding describes (SMBIOS SSIF record + >=2 smbus buses, or + ACPI IPI0001 SSIF stub)
is firmware-gated and cannot be constructed on this guest: QEMU's -smbios option only
supports types 0,1,2,3,4,17 — type 38 cannot be injected from the monitor either.

## Conclusion
Runtime reproduction is impossible on this guest by construction; the defect is a
statically-provable missing-guard code fact (guard_matrix.log). Same verification
posture as the sibling finding DF-5076 (ipmi2_pci_probe), which is 'untested' for
the same hardware-gating reason.