# DF-5444 VERDICT — REPRODUCED (kernel panic; card-driven DoS)

## Bottom line

`panic("pnp_set_config: bogus memory assignment")` (sys/bus/isa/pnp.c:261)
was triggered **through the real kernel flow** on the guest by a card
declaring `MEMORY32_RANGE base=0xE0001001 align=1 size=1`.  The single-fix
kernel (fix.diff) turns the identical stream into a graceful resource
rejection.

## Chain (all real code; rig only virtualizes the card's port behaviour)

  1. Card bytes → `pnp_parse_desc()` PNP_TAG_MEMORY32_RANGE stores arbitrary
     32-bit `ir_start`/`ir_align` — **no 256-byte granularity clamp**
     (pnpparse.c:295-300), unlike PNP_TAG_MEMORY_RANGE which forces
     align ≥ 0x10000 (pnpparse.c:266-269).
  2. `isa_driver_added()` child loop (isa_common.c:835-862) →
     `isa_assign_resources()` → `isa_find_memory()` (isa_common.c:128-148):
     candidate loop starts at the card base and steps by `MAX(align,1)` —
     with align=1 the *first* candidate is the misaligned base; rman grants
     it (0xE0001001 is free on this guest).
  3. Config callback = the real `pnp_set_config` (installed at pnp.c:456-457)
     → `start & 0xff` → **panic** (pnp.c:260-261).

Same reachability via PNP_TAG_MEMORY32_FIXED (pnpparse.c:323-328: fixed
arbitrary base, align=1).

## Evidence

Baseline (kernel #0): `panic.txt` / `serial_runB_full.log` —

    panic: pnp_set_config: bogus memory assignment
    pnp_set_config() at pnp_set_config+0x192
    isa_assign_resources() at isa_assign_resources+0x9e7
    isa_driver_added() at isa_driver_added+0x106
    devclass_add_driver() ... module_register_init()

Fixed (kernel #1, fix.diff): `fix_run.log` — `RUN_B_RC=0`,
`(null) can't assign resources (memory)` (rounded base no longer fits the
1-byte window → config rejected → device disabled), guest healthy.

## Fix

pnpparse.c: MEMORY32_RANGE/MEMORY32_FIXED granularity clamped to 0x100 with
bases rounded up; pnp.c: panic downgraded to kprintf + truncation (defense
in depth).  Validated above; full diff in `fix.diff` (shared with the
DF-5443/DF-5445 packs; build log in DF-5443/fix_build.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)