{
  "finding_id": "DF-5468",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "The ROM path of vga_pci_map_bios() is dead on spec-conformant devices. DF, unlike FreeBSD, never pre-reserves the expansion-ROM BAR in the device resource list during enumeration (pci.c:2720-2751 stop at BAR5), so vga_pci_map_bios()s allocation (vga_pci.c:217) falls into the lazy pci_alloc_map() (pci.c:4060), whose sizing dance writes 0xffffffff to the ROM BAR and reads back base_mask|enable_bit (PCI ROM BAR bit 0 is RW; empirically 0xffff0001 on the QEMU std VGA, captured in run.log and ../DF-5467/serial-full.log). PCI_BAR_MEM(testval) is then false (pcireg.h:170-171 test bit 0), so the SYS_RES_MEMORY request is rejected as an ioport BAR (pci.c:3958-3965) and map_bios prints vga_pci_alloc_resource failed and returns NULL (vga_pci.c:220-223). Consequence: non-boot-display VBIOS reads by drm (radeon_bios.c:86 and amdgpu/i915 equivalents) always fail on such hardware and the 1s/3s poll loops and D3-reset dance in map_bios are unreachable dead code. Fails closed - no memory unsafety - so impact none (functional degradation only). Reproduced live: rombar_probe.sh readback + the unseeded map attempts in the DF-5467 baseline session.",
  "exploit_chain": "",
  "evidence": "run.log (probe: current ROM BAR febc0000 -> write 0xffffffff -> readback ffff0001 -> restored); ../DF-5467/serial-full.log lines 20-29 (two unseeded map attempts, each vgapci0: vga_pci_alloc_resource failed); README.md code chain vga_pci.c:217 -> pci.c:4060 -> pci.c:3934-3966",
  "kernel_refs": [
    "sys/bus/pci/vga_pci.c:217",
    "sys/bus/pci/pci.c:3934",
    "sys/bus/pci/pci.c:3958",
    "sys/bus/pci/pci.c:4060",
    "sys/bus/pci/pci.c:2720",
    "sys/bus/pci/pcireg.h:170"
  ],
  "poc_changes": "seed sketch replaced by a root shell probe (pciconf write/read/restore of reg 0x30) - no build step needed; kernel-side alloc failure cited from the DF-5467 baseline serial log captured on the same kernel build",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "(none - shell probe)",
  "run_cmd": "vm.sh run_root sh /tmp/rombar_probe.sh",
  "code_hash": "54a097776629b87cbeef3baf096914324e18898310159b6a7ebe40196cf94ef6",
  "notes": "Fails closed; security impact none, filed as a correctness/robustness finding in the vga_pci ROM-handling family (checklist item (a)). Also documents why DF-5467s chain needs the ROM rle pre-seeded on this guest. The probe is kernel-build independent (config-space readback); captured on the stock baseline kernel.",
  "recommended_fix": "Pre-reserve the ROM BAR (PCIR_BIOS) in the resource list during enumeration like FreeBSD, or mask the ROM decode-enable bit (testval &= ~0x1 for rid PCIR_BIOS/PCIR_BIOS_1) in pci_alloc_map() before the PCI_BAR_MEM classification - diff in README.md",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not validated on a rebuilt kernel (impact none; the fix is a one-line pci.c classification change and the DF-5467 fix-validation cycle covers the same file familys build); readback probe is fix-independent evidence",
  "fix_evidence": "README.md carries the proposed pci.c diff; run.log carries the readback proof",
  "fix_kernel_uname": ""
}