{
  "finding_id": "DF-5511",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "REPRODUCED 4/4 pristine runs. ppb_release_bus() clears ppb->ppb_owner at ppbconf.c:528 and only then reads ppb_get_mode() into ppbdev->ctx.mode at :532 -- outside any critical section -- so a second ppbus child (lpt/ppi/pcfclock all attach to the same bus) that acquires the bus and calls ppb_set_mode() inside that window has ITS mode snapshotted into the releasing devices context; ppb_request_bus() later restores that wrong mode for the first device (:491-492). Rig: releaser thread (device A, mode PS2) and stealer thread (device B, mode EPP) race request/set_mode/release for 50M iterations on the 6-vCPU guest: 2/1/1/6 wrong-mode captures across the four runs (As ctx.mode == Bs EPP), every capture provably written by As own release call (no other writer of As ctx). Impact ceiling: cross-device chipset-mode corruption on the shared port (wrong IEEE1284 protocol restored for lpt/pcfclock/ppi transfers -> printer data corruption / hung transfers), no memory-safety consequence; device nodes are 0600 root:wheel by default and the port is hardware-gated. Fix validated: with ctx saved under crit while still owner, 0 wrong captures in 50M iterations on two patched runs.",
  "exploit_chain": "",
  "evidence": "run.log (DF-5511 releaser ... WRONG-mode-captured(Bs EPP in As ctx)=6 -> REPRODUCED on the pristine decisive run); fix_run.log (=0 on patched); harness.c hx_f2_releaser/hx_f2_stealer; fix.diff hunk 4.",
  "kernel_refs": [
    "sys/bus/ppbus/ppbconf.c:528",
    "sys/bus/ppbus/ppbconf.c:532",
    "sys/bus/ppbus/ppbconf.c:491",
    "sys/bus/ppbus/ppbconf.c:483"
  ],
  "poc_changes": "No seed PoC existed (pass-2 finding); rig written from scratch following the DF-5418/5419 ppbharness class: verbatim-source KLD (ppbconf.c+ppb_1284.c+ppb_base.c), scripted IEEE1284 nibble-mode peer, fake ppc controller on nexus, real ppbus driver attach. Bring-up fixes: comment typo; the stack pre-dirtier initially collapsed to a single frame via -O2 tail-call optimization (made noinline with a post-call touch).",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 75,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh  (guest: cp harness.c Makefile /tmp/ppx2; make SYSDIR=/usr/src/sys)",
  "run_cmd": "kldload /tmp/ppx2/ppbharness2.ko; sleep 75; dmesg | grep PPBX2   (sh run.sh)",
  "code_hash": "eaa32f734c11c69696b7b680eca63a67cc24686475391b9b09cbd0c55c6be222",
  "notes": "Race window is a handful of instructions (owner=0 then get_mode); ~1e-7 hit rate per release measured; the corrupted ctx is restored at the devices next ppb_request_bus (ppbconf.c:491-492), making the wrong mode persistent for that device.",
  "recommended_fix": "Save ppbdev->ctx.{mode,valid} inside the crit section BEFORE clearing ppb_owner (fix.diff hunk 4).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied to the guests /usr/src/sys/bus/ppbus/ppbconf.c, harness rebuilt from the same verbatim source (module-level rebuild; running kernel unchanged), full rig re-run on a fresh boot: the previously observed bad behavior is GONE (0 wrong captures in 50M iterations, verified on two patched boots). Behavior of the sibling known findings (DF-1093/2327/2328/2329) was not targeted by this diff.",
  "fix_evidence": "fix_run.log / fixrun2.dmesg (patched) vs run.log / run4.dmesg (pristine) in this pack; fix.diff is the exact applied diff.",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64"
}