# DF-5521 — iicsmb detach has no quiesce: kldunload during an in-flight SMBus transaction executes freed module text (UAF) and leaves `iicbus_softc->owner` dangling

## What this is

Evidence pack for the pass-2 finding against `sys/bus/iicbus/iicsmb.c`
(the I2C-to-SMBus bridge).  Verified on the QEMU guest with a software
I2C controller KLD so that the **production** module chain

    isa -> dfa_iic0 -> iicbus0 -> iicsmb0 -> smbus0 -> smb0 (/dev/smb0)

runs entirely on stock/production code paths (only the wire is software).

## Files

  df5521_rig.c     software iicbus controller (isa child, wire-logged,
                   configurable READ sleep = in-flight window, sysctl to
                   inject iicbus_intr events like a real controller ISR)
  df5521_poc.c     userland PoC (root): proto / groom / race / racefixed /
                   fireevent modes against /dev/smb0
  build.sh         exact guest build commands
  load_chain.sh    module load order bringing the chain up
  run.sh           baseline reproduction (expects panic)
  panic.txt        captured serial-console panic (freed-text execution)
  run.log          baseline session transcript excerpts
  run.fixed.log    fix-validation transcript (EBUSY + clean unload + alive)
  fix.diff         validated fix (iiconf.c accessor + iicsmb.c guard +
                   smbus.c guard)
  build.log        decisive compiler/link lines (guest, -Werror, clean)
  env.txt          guest uname / kldstat / toolchain
  manifest.json    machine-readable catalog
  verdict.json     machine verdict (persist_poc.py schema)

## Reproduce (baseline)

1. `vm.sh reset with-src`, `vm.sh up`
2. push `df5521_rig.c df5521_poc.c` to guest `/root`
3. guest: `sh /root/build.sh` (see build.sh)
4. guest: `sh /root/load_chain.sh`
5. guest: `sysctl hw.dfa.rdelay=300`
6. guest: `/root/df5521_poc race`
7. EXPECT: `smb0: detached / smbus0: detached / iicsmb0: detached`,
   then the sleeping child wakes and the console shows
   `Fatal trap 12: page fault ... fault virtual address = 0xffffffff8261f0bf`
   (inside the unloaded iicsmb.ko text range) -> DDB `db>` prompt.

## Reproduce (fix validation)

Apply `fix.diff` inside the guest's `/usr/src`, rebuild iicbus.ko +
iicsmb.ko and (because `smbus` is compiled into X86_64_GENERIC) the
kernel (`make nativekernel && make installkernel`, reboot), then:

    kldload iicbus && kldload iicsmb && kldload smb && kldload df5521_rig.ko
    sysctl hw.dfa.rdelay=300
    /root/df5521_poc racefixed

EXPECT: `kldunload: can't unload file: Device busy` while the child is
mid-BREAD, child continues unharmed, and after the client stops the
unload succeeds; guest alive.