# DF-5372 VERDICT — REPRODUCED (combined bus_dmamap_sync op is a silent no-op on vkernel64)

## Root cause

`sys/platform/vkernel64/platform/busdma_machdep.c:913-938`:
`_bus_dmamap_sync()` dispatches on `switch (op)`. `bus_dmasync_op_t` is a
bitmask (sys/sys/bus_dma.h:118-121), so the legal combined operation
`BUS_DMASYNC_PREWRITE|BUS_DMASYNC_POSTREAD` (0x06) matches no case and both
bcopy loops are skipped. pc64's implementation uses `if (op & ...)`
(pc64 busdma_machdep.c ~:1044) — the vkernel64 fork predates/misplaced that
fix.

## Reproduction (VKERNEL64 vkernel, -m 512m, guest DragonFly 6.5-DEVELOPMENT)

Driver (dfbusdma.c, compiled in, SYSINIT): 8192-alignment bounce tag (default
`hw.busdma.bounce_alignment=1` confirmed = 1), misaligned 64-byte buffer
loaded via bus_dmamap_load (bounce page attached, datacount=64 verified),
then:

1. control `bus_dmamap_sync(tag, map, BUS_DMASYNC_PREWRITE)` — client
   pattern appears in the bounce page ("PREWRITE alone: copy ok").
2. bug case: bounce page pre-planted with "PLANTED-IN-BOUNCE!!", client
   buffer set to "COMBINED-OP-PATTERN!!", then
   `bus_dmamap_sync(tag, map, BUS_DMASYNC_PREWRITE|BUS_DMASYNC_POSTREAD)`.
   Result: bounce page still holds PLANTED, client still holds PATTERN —
   neither direction copied anything ("SILENT NO-OP (bug confirmed)",
   "VERDICT PROVEN"). Vkernel stayed ALIVE.

## Fix validation

fix.diff converts the switch to bitmask tests (pc64 form). With it applied
(and DF-5370's fix, layered earlier): "combined PREWRITE|POSTREAD: honored",
"VERDICT NOT PROVEN" — i.e. the previously-observed no-op is gone; both
copies execute.

## Notes

- No stock VKERNEL64 driver calls bus_dma (vkd/vke/vcd do not), so this is a
  latent data-integrity bug for any kldloaded bus_dma driver using combined
  sync ops — Low severity.
- PREWRITE-skip means the device would DMA stale cross-buffer contents from
  the shared bounce pool (data confusion); POSTREAD-skip means device data
  never lands (silent corruption).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.