{
  "finding_id": "DF-5203",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Pass-2 audit of the IPMI SMBus frontend (the 4th transport glue). The driver enforces a driver-wide singleton via the global ipmi_attached (ipmi.c:65, set to 1 by every successful ipmi_attach at ipmi.c:864 and never checked inside ipmi_attach itself); the check lives in the frontend probes -- ipmi_pci_probe honors it (ipmi_pci.c:77), ipmi_isa_probe (ipmi_isa.c:85), ipmi_acpi_probe (ipmi_acpi.c:62), and DF-5076 already filed the unguarded ipmi2_pci_probe (ipmi_pci.c:183-193) claiming to be the only omission. It is not: ipmi_smbus_probe (ipmi_smbus.c:65-71) also unconditionally claims any ipmi child on an smbus bus, and ipmi_smbus_identifys dedup (ipmi_smbus.c:61) is per-parent only (device_find_child on that smbus bus), not global. On firmware whose SMBIOS type-38 record says SSIF and which exposes >=2 smbus buses (or an ACPI IPI0001 _IFT=SSIF stub -- which per DF-5145 attaches a dead softc WITHOUT setting ipmi_attached, so it blocks nothing), each smbus bus gets an ipmi child, each unguarded probe claims it, and each attach (ipmi_smbus.c:73-112; the only gate is the same SMBIOS records iface_type==SSIF at :84) runs ipmi_ssif_attach + ipmi_attach again: second config_intrhook, second ssif_loop kthread (ipmi_ssif.c:314-351,357), second /dev/ipmiN cdev (ipmi.c:831), two watchdog callouts arming the same BMC watchdog, and two threads issuing interleaved multi-part SMBus block transactions (WRITE_START/WRITE_CONT/READ_*) to one BMC address. Ceiling is wedged-BMC DoS and confused watchdog state, not memory corruption (softcs are independent and locked; identical analysis to DF-5076). Severity Low: purely firmware-gated topology, no runtime attacker control. Untestable on this guest by construction (env.txt): pciconf shows no class 0c:05 device so zero smbus buses exist, there is no SMBIOS type-38 record and QEMU cannot inject one (-smbios covers types 0,1,2,3,4,17 only); live kldload ipmi demonstration attached nothing and was unloaded, guest left clean. Static proof in guard_matrix.log; fix.diff adds the sibling guard (git apply --check verified, never applied to sys/). FreeBSD HEAD carries the identical omission. Negative results (VERDICT.md section 4): identify/attach unwind complete and single-shot (ipmi_ssif_attach allocates nothing and cannot fail; only effectively-unreachable post-ssif failure is config_intrhook ENOMEM; ipmi_release_resources covers everything this frontend holds), uint64->int address narrowing cannot corrupt the 7-bit SMBus address and lands in the bounds-checked smbus core, iface dispatch fully partitions, detach glue is the shared guarded ipmi_detach with proper ssif kthread drain, and the file is live code in every ipmi.ko build (sys/conf/files:1054, Makefile SRCS). Known family findings NOT re-reported: DF-4777 (kcs), DF-4948 (smic), DF-4978 (ssif replylen), DF-5076 (ipmi2_pci guard), DF-5145 (acpi stub), DF-2107 (smbios walk).",
  "exploit_chain": "",
  "evidence": "guard_matrix.log (guard at ipmi_pci.c:77 / ipmi_isa.c:85 / ipmi_acpi.c:62, count 0 in ipmi_smbus.c; consequence chain to 2nd kthread/cdev); VERDICT.md sections 1-3; env.txt (guest: no 0c:05 device, no SMBIOS type-38, live kldload ipmi no-op demo); fix.diff (git apply --check passes, never applied)",
  "kernel_refs": [
    "sys/dev/misc/ipmi/ipmi_smbus.c:65-71",
    "sys/dev/misc/ipmi/ipmi_smbus.c:55-63",
    "sys/dev/misc/ipmi/ipmi_smbus.c:73-112",
    "sys/dev/misc/ipmi/ipmi_pci.c:77-78",
    "sys/dev/misc/ipmi/ipmi_isa.c:85-86",
    "sys/dev/misc/ipmi/ipmi_acpi.c:62-63",
    "sys/dev/misc/ipmi/ipmi_acpi.c:104-109",
    "sys/dev/misc/ipmi/ipmi.c:65",
    "sys/dev/misc/ipmi/ipmi.c:841-866",
    "sys/dev/misc/ipmi/ipmi.c:831",
    "sys/dev/misc/ipmi/ipmi_ssif.c:314-351",
    "sys/dev/misc/ipmi/ipmi_ssif.c:353-359",
    "sys/dev/misc/ipmi/ipmi_ssif.c:361-374",
    "sys/conf/files:1054"
  ],
  "poc_changes": "evidence pack authored fresh in pass 2 (no seed). No runtime PoC exists or is constructible: the double attach requires SMBIOS type-38 SSIF firmware plus a second smbus bus; the audit guest has neither (no 0c:05 PCI function, QEMU cannot inject type 38). Live kldload ipmi probe performed instead to prove identify is a no-op without the firmware record.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "n/a (static code-fact finding; guard_matrix.log is the proof artifact)",
  "run_cmd": "n/a -- no smbus bus / no SMBIOS type-38 on the guest; see env.txt for the live kldload ipmi demonstration (loaded, nothing attached, unloaded clean)",
  "code_hash": "",
  "notes": "pass 2 (GLM 5.3). Corrects DF-5076s only unguarded probe claim: ipmi_smbus_probe is a second instance in a different file. Guest was already up; only read-only env collection + one load/unload cycle; left clean.",
  "recommended_fix": "Add the singleton guard to ipmi_smbus_probe mirroring the siblings: if (ipmi_attached) return (ENXIO); -- see fix.diff (same fix applies to FreeBSD HEAD).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable - requires SMBIOS type-38 SSIF firmware plus >=2 smbus buses (or the ACPI IPI0001 SSIF stub); the audit guest has no smbus bus at all and QEMU cannot supply type-38 SMBIOS records. fix.diff is git-apply --check verified against the pristine sys/ tree and mirrors the three in-tree sibling guards exactly; logically airtight for a guard-insertion fix.",
  "fix_evidence": "findings/poc/DF-5203/fix.diff (git apply --check passes; never applied to sys/)"
}