{
  "finding_id": "DF-5508",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Trace-proven lifecycle gap, not executable on any available rig (AMD-8111 hardware-gated; the harness rig of DF-5506 drives the code paths directly and cannot reproduce a kldunload-vs-ioctl race without the real newbus attach). amdsmb_detach (amdsmb.c:175-191) does not drain in-flight transactions: /dev/smbN teardown does not wait for threads inside smbioctl (smb.c:151-152 removes devfs minors only) and amdsmb_callback is a no-op (amdsmb.c:193-207), so a thread holding sc->lock inside the up-to-5.4s amdsmb_wait spin (amdsmb.c:287-291) is still running when kldunload reaches lockuninit(&sc->lock) (amdsmb.c:185) — lockmgr state corruption on a held lock — and then bus_release_resource (amdsmb.c:186-188) frees the I/O range under live bus_read_1/bus_write_1 use (post-release port I/O to a potentially reassigned device). Requires open /dev/smbN fd + in-flight ioctl + concurrent kldunload, all root-only: Info severity, speculative execution but likely correctness, certain code-shape. Folded below threshold: attach ignores bus_generic_attach return (amdsmb.c:170).",
  "exploit_chain": "",
  "evidence": "README.md trace with path:line; ichsmb sibling DF-5460 (Info) for family pricing",
  "kernel_refs": ["sys/bus/smbus/amdsmb/amdsmb.c:175", "sys/bus/smbus/amdsmb/amdsmb.c:185", "sys/bus/smbus/amdsmb/amdsmb.c:186", "sys/bus/smbus/amdsmb/amdsmb.c:193", "sys/bus/smbus/amdsmb/amdsmb.c:287", "sys/bus/smbus/amdsmb/amdsmb.c:170", "sys/dev/smbus/smb/smb.c:151"],
  "poc_changes": "no PoC — trace-only (root-gated + hardware-gated race; Info severity)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "",
  "notes": "Info severity per rubric (requires already-privileged user). No fix.diff authored (unverified); prose fix in README.md and recommended_fix.",
  "recommended_fix": "Drain in-flight ops before lockuninit (detaching flag + LK_DRAIN-style lock acquisition; op wrappers return ENXIO once detaching); check bus_generic_attach return in attach.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Not testable on this rig (no AMD-8111 device; race requires real newbus attach + kldunload timing).",
  "fix_evidence": ""
}