# DF-5357 VERDICT — pccard_driver_added NULL pf->dev dereference

## Status: statically certain NULL-deref; trigger requires root (kldload), Low severity; not runnable in QEMU (no PCMCIA bridge)

## Trace

* Card inserted with erroring CIS → `pccard_read_cis` populates
  `sc->card.pf_head` (functions + cfe chains) and increments
  `sc->card.error` (`sys/bus/pccard/pccard_cis.c:1053/1173/1188/1202`).
* `pccard_attach_card` returns 1 at `sys/bus/pccard/pccard.c:205-208`
  **before** the child-creation loop at `pccard.c:233-259` — every
  `pf->dev` remains NULL (functions are `M_ZERO`-allocated,
  `pccard_cis.c:790-791/837-838`).
* `kldload` of a module with a `DRIVER_MODULE(x, pccard, ...)` →
  `devclass_add_driver` → `bus_generic_driver_added` → `pccard_driver_added`.
* `pccard.c:1084-1085`: `child = pf->dev` (NULL) → `device_get_state(NULL)`
  → `return(dev->state);` (`sys/kern/subr_bus.c:1824-1827`) → page-fault at
  offsetof(struct device, state) → panic.

The sibling walk in `pccard_detach_card` guards this exact condition
(`if (pf->dev == NULL) continue;`, `pccard.c:304-305`); `pccard_driver_added`
simply forgot it.

## Impact

Local kernel panic; the triggering action (kldload) needs root, so this is
hardening/robustness (Low), same class as DF-1489.

## Not reproduced on guest

No PCMCIA bridge in QEMU → `pf_head` can never be non-empty on the guest;
static certainty only. Model adds nothing (single missing NULL check).

## Fix

One-line guard (fix.diff), mirroring `pccard.c:304-305`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.