# DF-5525 VERDICT — REPRODUCED (kernel panic from a controller-supplied event value; hardening fix validated)

## The bug

`iicsmb_intr()` handles INTR_GENERAL/START/STOP/RECEIVE/TRANSMIT/NOACK/
ERROR and then (`sys/bus/iicbus/iicsmb.c:242-243`):

    default:
        panic("%s: unknown event (%d)!", __func__, event);

The event is an unvalidated int produced by whatever controller driver
sits under the iicbus and is delivered through the production interrupt
path (`iicbus_intr()` → `IICBUS_INTR(sc->owner)`, `iiconf.c:45-51`).
`iicbus_if.m` defines no contract that pins producers to {1..7}; a
controller bug (or a new event added to one driver but not the bridge —
exactly how INTR_NOACK-style additions happen) turns one stray status code
into a full system panic.  Fault isolation, not attacker-reachable data:
severity Info.

## Verification

Baseline (stock modules, production chain up, owner held by an in-flight
SMB_BREAD): firing `iicbus_intr(iicbus0, 153, &c)` — the same call
pcfintr makes on 8 paths — produced:

    panic: iicsmb_intr: unknown event (153)!
    iicsmb_intr() at iicsmb_intr+0x67
    dfa_fire_event_sysctl() at ...
    sysctl_root ... userland_sysctl ... sys___sysctl
    Debugger("panic")  → db>

Fixed (`panic` → `kprintf` + `break`): `iicsmb_intr: unknown event (153)!`
is logged, `iicbus_intr returned (no fault)`, the in-flight transaction
completes, `/dev/smb0` remains, guest alive.

## Fix

`fix.diff`: log-and-continue.  (An upstream-grade alternative is
`KASSERT` under DEBUG discipline; the kprintf preserves diagnosability
without the system-down failure mode.)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.