{
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "guest: sh build.sh (rig KLD + PoC); fix validation: patch -p1 < fix.diff in /usr/src, rebuild iicbus/iicsmb/smb modules + nativekernel+installkernel (smbus is in-kernel), reboot",
    "run": "sh load_chain.sh; sysctl hw.dfa.rdelay=300; /root/df5521_poc race   (baseline panics); /root/df5521_poc racefixed   (fixed: Device busy + clean unload)",
    "expected": "baseline: 'smb0/smbus0/iicsmb0: detached' then Fatal trap 12 at 0xffffffff8261f0bf (unloaded iicsmb.ko text) -> db>; fixed: 'kldunload: can't unload file: Device busy', child unharmed, clean unload after client stops, guest alive"
  },
  "kernel_refs": [
    "sys/bus/iicbus/iicsmb.c:164",
    "sys/bus/iicbus/iicsmb.c:510",
    "sys/bus/iicbus/iiconf.c:50",
    "sys/kern/subr_bus.c:853",
    "sys/dev/smbus/smb/smb.c:240",
    "sys/bus/smbus/smbus.c:108"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "df5521_rig.c", "df5521_poc.c",
    "build.sh", "load_chain.sh", "run.sh", "build.log", "env.txt",
    "run.log", "run.fixed.log", "panic.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}