{
  "finding_id": "DF-5479",
  "status": "inconclusive",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "efi_enter() (efirt.c:342-359) opens a runtime-services window that mutates PER-CPU state (CR4.SMEP cleared via smap_smep_disable, pmap.c:1389) with no critical section and no CPU pinning \u2014 the comment at efirt.c:327-330 claims fpu_kern_enter enters a critical section, but the DragonFly port calls npxpush() (npx.c:340-374) which enters none. If the calling thread is preempted inside the window and migrates: the destination CPU still has SMEP armed, so firmware executing at 1:1 U/S=1 addresses (the efi map is a user map inserted RWX, efirt.c:214/224-231) takes an SMEP #PF at CPL0 that vm_fault fixes (page present+exec, trap.c:961) and immediately retakes \u2014 an infinite fault loop holding efi_lock forever (all EFI ioctls and shutdown efi_reset_system block permanently); meanwhile the source CPU keeps CR4.SMEP cleared forever (only boot pmap.c:1355 and efi_leave pmap.c:1396 ever touch the bit; verified by grep \u2014 no context-switch restore). Not verifiable on this rig: the guest boots legacy BIOS, efi_runtime == NULL, efi_enter fails at efirt.c:347-348, the window cannot be opened. Established by complete code trace; needs an EFI (OVMF) SMP guest with a preemption workload to reproduce.",
  "exploit_chain": "",
  "evidence": "VERDICT.md step-by-step trace with path:line for every claim: efirt.c:327-359 (no crit/pin, comment mismatch), pmap.c:1366-1399 (CR4.SMEP global-per-CPU mutation), npx.c:340-374 (no critical section), trap.c:894-997 (pcb_onfault=1 bypass at :920, vm_fault success at :961, no rip reload at :990-995), pmap.c:1355 (only other CR4_SMEP touchpoint).",
  "kernel_refs": [
    "sys/platform/pc64/x86_64/efirt.c:327",
    "sys/platform/pc64/x86_64/efirt.c:342",
    "sys/platform/pc64/x86_64/efirt.c:354",
    "sys/platform/pc64/x86_64/efirt.c:356",
    "sys/platform/pc64/x86_64/pmap.c:1366",
    "sys/platform/pc64/x86_64/pmap.c:1383",
    "sys/platform/pc64/x86_64/pmap.c:1389",
    "sys/platform/pc64/x86_64/npx.c:340",
    "sys/platform/pc64/x86_64/trap.c:917",
    "sys/platform/pc64/x86_64/trap.c:961"
  ],
  "poc_changes": "No PoC built: path requires EFI boot (runtime services active); the BIOS-boot rig cannot open the window. Analysis-only evidence pack.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Expected impact if triggered on EFI hardware: permanent wedge of all EFI services (DoS) plus permanent per-CPU SMEP defeat. Minimal fix mirrors FreeBSD: crit_enter()/crit_exit() around the smap_smep_disable..smap_smep_enable window (DFly crit sections prevent preemption and cross-CPU pulls), or per-CPU SMEP borrowed flag restored in the switch path.",
  "recommended_fix": "Enter a critical section for the whole efi_enter..efi_leave window (or pin to the CPU and restore CR4.SMEP on deschedule) so the per-CPU SMEP mutation cannot leak across a migration.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No fix validation possible on this rig (baseline itself not reachable: BIOS boot, efi_runtime NULL).",
  "fix_evidence": ""
}