# DF-5517 VERDICT — reproduced (production-code request-sequence proof)

## Finding

`VENDOR_CLEAR_BREAK` (0x03) is **defined at ubser.c:102 and referenced
nowhere else in the driver** (build.sh's grep: exactly 1 occurrence — the
#define). `ubser_cfg_set_break()` (ubser.c:462-487) only issues a device
request inside `if (onoff)` (ubser.c:470) — the SET command (0x02) — and has
no else-leg: when the ucom core asks it to clear the break
(TIOCCBRK, usb_serial.c:1194-1197 -> ucom_cfg_line_state's clear pass,
usb_serial.c:1401-1403/1415-1417) it silently issues nothing.

Consequence: once a break is set on a BWCT port (TIOCSBRK), the device's
line stays in break **until the adapter is power-cycled**; TIOCCBRK and port
close are kernel-side no-ops. Every subsequent byte transmitted on that port
is garbled at the far end (a break is a sustained space condition) — a
one-way functional kill of the serial port for any tty opener.

## Reproduction

The harness includes the **unmodified** production `ubser.c` (registration
neutered, md5-gated) and drives the **real** `ubser_cfg_set_break()` through
the real `usb_process` taskqueue with the exact `ucom_cfg_line_state`
arithmetic (usb_serial.c:1384-1420); the modeled EP0 sink only records the
bRequest values the production code asks to send.

Measured (run.log / run.2.log):

| phase | scenario | baseline | fixed |
|---|---|---|---|
| L | open -> TIOCSBRK -> TIOCCBRK -> close (full lifecycle) | `{ 0x02 }` — CLEAR **NEVER OBSERVED** | `{ 0x02, 0x03 }` |
| D | direct `ubser_cfg_set_break(ucom,1); (ucom,0)` on a live port | `{ 0x02 }` | `{ 0x02, 0x03 }` |

Static proof (build.sh, echoed into build.log): `VENDOR_CLEAR_BREAK`
occurs exactly once in ubser.c — its definition.

## Fix validation

fix.diff (adds the else-leg mirroring the SET request shape: wValue=portno,
wIndex=iface, VENDOR_CLEAR_BREAK, bounded 250 ms timeout) applied to the
guest's /usr/src; harness rebuilt -Werror clean; rerun: both phases observe
`0x03` (run.fixed.log). Guest tree restored and md5-verified
(85afa08fa4f618c9288a6dca75d9e671). `git apply --check` passes against the
audited host repo.

## Impact

Functional correctness / availability of the port for a tty opener
(root via ttyU* 0600, group dialer via cuaU* 0660, usb_serial.c:477-488);
no kernel memory-safety impact; fails OPEN (line stuck broken) not closed.
Low. Upstream-inherited defect (FreeBSD ubser.c has the identical shape) —
worth fixing in both trees.

## Honest scope notes

- No physical BWCT device exists on the guest: the harness proves the
  kernel never SENDS the clear command (request-sequence proof); the
  device-side effect (line stays broken) follows from the device protocol
  the constants describe (ubser.c:99-102 Vendor Interface Requests).
- The fixed else-leg keeps the driver's existing (odd but evidently
  device-correct) `UT_READ_VENDOR_INTERFACE` request shape used by SET.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.