# DF-5346 — SMAP missing from the hypervisor feature blacklist in identify_cpu()

## Where

`sys/platform/pc64/x86_64/identcpu.c`

```c
664: 	if (cpu_high >= 7) {
665: 		cpuid_count(7, 0, regs);
666: 		cpu_stdext_feature = regs[1];
667: 
668: 		/*
669: 		 * Some hypervisors fail to filter out unsupported
670: 		 * extended features.  For now, disable the
671: 		 * extensions, activation of which requires setting a
672: 		 * bit in CR4, and which VM monitors do not support.
673: 		 */
674: 		if (cpu_feature2 & CPUID2_VMM) {
675: 			cpu_stdext_disable = CPUID_STDEXT_FSGSBASE |
676: 					     CPUID_STDEXT_SMEP;
677: 		} else {
678: 			cpu_stdext_disable = 0;
679: 		}
```

The comment defines the rule: under a VMM, mask CPUID.7.EBX bits whose
activation writes a CR4 bit that VM monitors may not support. SMAP
(`CPUID_STDEXT_SMAP`, bit 20) qualifies exactly — its activation writes
CR4.SMAP in `cpu_implement_smap()` (machdep.c:344-346, invoked from
cpu_startup when `cpu_stdext_feature & CPUID_STDEXT_SMAP`) — but it is not
in the mask. SMEP is masked; SMAP is not. A hypervisor that advertises
SMAP without supporting CR4.SMAP (the same class of bug that motivated the
mask — VirtualBox advertising SMEP circa 2014) makes the kernel take a #GP
writing CR4 during early boot → boot panic.

## On-guest documentation (QEMU 7.2.22, KVM)

`-cpu qemu64,+smap,check=off` boots:

```
Features2=0x80202001<SSE3,CX16,x2APIC,VMM>          <- VMM detected
Structured Extended Features=0x100000<SMAP>          <- SMAP advertised under VMM
CPU Special Features Installed: SMAP                 <- blacklist passed it through
```

…reaching `login:` cleanly (QEMU/KVM implements CR4.SMAP, so no fault —
expected). This documents the pass-through; the fault case requires a
CR4.SMAP-faulting hypervisor, which stock QEMU cannot emulate.

Class: defense-in-depth consistency / lying-CPUID boot DoS. Speculative —
no known shipping hypervisor currently trips it; filed because the file's
own rule says this bit belongs in the mask (and `hw.cpu_stdext_disable`
users can add it manually at the loader prompt).

## Fix

```diff
 		if (cpu_feature2 & CPUID2_VMM) {
 			cpu_stdext_disable = CPUID_STDEXT_FSGSBASE |
 					     CPUID_STDEXT_SMEP |
+					     CPUID_STDEXT_SMAP;
 		}
```