{
  "verdict": "reproduced",
  "impact": "dos",
  "reproduce": {
    "build": "in guest: mkdir -p /root/ehcipwn && cp poison.c Makefile there && make KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC",
    "run": "kldload /root/ehcipwn/ehcipwn.ko ; QEMU monitor: device_add usb-kbd,id=k1,bus=ehci0.0,port=1",
    "expected": "read/write-path geometry confusion immediately (GET_STATUS port 0x0400 vs 0x0500; poisoned SET_SUSPEND never reaches real PORTSC); first port-change interrupt live-locks the machine: ssh dead within ~20s, console silent, qemu spinning, vm.sh status down. Control without poison: ukbd0 attaches, guest healthy."
  },
  "kernel_refs": [
    "sys/bus/u4b/controller/ehci.c:308",
    "sys/bus/u4b/controller/ehci.c:327",
    "sys/bus/u4b/controller/ehci.h:351",
    "sys/bus/u4b/controller/ehci.h:372-383",
    "sys/bus/u4b/controller/ehci.h:330",
    "sys/bus/u4b/controller/ehci_pci.c:316-324",
    "sys/bus/u4b/controller/ehci.c:1504-1513",
    "sys/bus/u4b/controller/ehci.c:1429-1441",
    "sys/bus/u4b/controller/ehci.c:2068",
    "sys/bus/u4b/controller/ehci.c:3251-3468",
    "sys/bus/u4b/controller/ehcireg.h:139"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "poison.c", "Makefile",
    "baseline.sh", "poisoned.sh", "build.sh", "run.sh",
    "build.log", "run.log", "fix_build_guest.log",
    "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}