{
  "finding_id": "DF-5525",
  "status": "reproduced",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "REPRODUCED: iicsmb_intrs default case panics on any iicbus event outside {1..7} (iicsmb.c:242-243). The event int is produced by the controller driver under the bus and delivered through the production interrupt path (iicbus_intr -> IICBUS_INTR(sc->owner), iiconf.c:45-51) with no interface-level contract bounding it (iicbus_if.m). Injecting event 153 the way a controller ISR would (same call pcfs pcfintr makes on 8 paths) with the owner held by an in-flight SMB_BREAD: panic: iicsmb_intr: unknown event (153)! with backtrace iicsmb_intr+0x67 <- dfa_fire_event_sysctl <- sysctl_root <- userland_sysctl <- sys___sysctl -> DDB. With the fix (kprintf + break): iicsmb_intr: unknown event (153)! logged, iicbus_intr returns, transaction completes, guest alive. Fault-isolation/robustness defect reachable only via controller-driver code (not attacker data) => severity Info.",
  "exploit_chain": "",
  "evidence": "panic.txt (decisive: panic string + full backtrace through the production iicbus_intr dispatch with sc->owner set); run.fixed.log (kprintf instead of panic, guest alive, /dev/smb0 intact); fix.diff",
  "kernel_refs": [
    "sys/bus/iicbus/iicsmb.c:182",
    "sys/bus/iicbus/iicsmb.c:242",
    "sys/bus/iicbus/iicsmb.c:243",
    "sys/bus/iicbus/iiconf.c:45",
    "sys/bus/iicbus/iiconf.c:50",
    "sys/bus/iicbus/iicbus_if.m:38"
  ],
  "poc_changes": "shared rig with DF-5521; hw.dfa.fire_event sysctl injects iicbus_intr() on the rigs iicbus child exactly as a controller ISR would",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 9600,
  "guest_dirty": 0,
  "build_cmd": "same as DF-5521 (shared rig)",
  "run_cmd": "sysctl hw.dfa.rdelay=300; /root/df5521_poc fireevent   (baseline: panic -> db>; fixed: kprintf, alive)",
  "code_hash": "16fea8b1ba1d070dbd19dae52d1bcdaa1d4d6aeb3c9d4ad4d534a430677d5eb4",
  "notes": "Info-severity hardening: no in-tree controller currently emits an out-of-range event, so the panic is latent until a controller driver regression or a third-party KLD; the sink is nonetheless a production panic path and was exercised live through the real dispatch (owner set).",
  "recommended_fix": "Replace the panic in the default case with a kprintf + break (or KASSERT under a debug option). See fix.diff (validated live).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "Stock: 1/1 runs panic (iicsmb_intr: unknown event (153)!, DDB). Patched: 1/1 clean -- event logged, iicbus_intr returns, in-flight transaction completes, /dev/smb0 intact, guest alive. Validated as part of the combined fixed-module build shared with DF-5521/5522/5523.",
  "fix_evidence": "panic.txt vs run.fixed.log; fix.diff"
}