{
  "finding_id": "DF-5590",
  "status": "inconclusive",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code-certain defect, runtime-inconclusive on this rig: isavga_attach() (sys/bus/isa/vga_isa.c:144-148) activates the legacy VGA windows (I/O 0x3c0-0x3df, MEM 0xa0000-0xbffff) discarding both bus_alloc_resource() returns, and returns early at :150-152 (vga_attach_unit failure \u2014 the EXPECTED outcome on BIOS hardware without VGA decode, since vga_probe() returns 0 even when verify_adapter() failed, vga.c:838-853) or :158-160 (fb_attach failure, leaking the make_devd cdev) without releasing them; the method table at vga_isa.c:66-74 has no detach/shutdown, so the claims are permanent. Live baseline on the QEMU guest (vga0 attached on isa1, devinfo -rv shows both claims, run.log) proves the claim mechanism exactly as traced, but the failure branch cannot be entered because the rigs Bochs VGA always passes verify_adapter() and QEMU args are fixed by vm.sh \u2014 a hardware-absence trigger, not a guest-expressible software precondition. No memory corruption; ceiling is permanent legacy-window rman starvation (blocks later kldloaded claimants with EBUSY) plus a LINT-only cdev leak.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5590/run.log (dmesg vga0 ... at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa1 + devinfo -rv claims); VERDICT.md (line-by-line trace: probe success-on-absent-hardware at vga.c:846-852, resource_list_alloc isdefault path subr_bus.c:2693-2698, vga_init ENXIO at vga.c:855-859, no unwind at vga_isa.c:151-152/159-160, no detach at vga_isa.c:66-74); env.txt (GENERIC, no FB_INSTALL_CDEV, no /dev/vga0)",
  "kernel_refs": [
    "sys/bus/isa/vga_isa.c:144-148",
    "sys/bus/isa/vga_isa.c:150-152",
    "sys/bus/isa/vga_isa.c:156-160",
    "sys/bus/isa/vga_isa.c:66-74",
    "sys/dev/video/fb/vga.c:838-853",
    "sys/dev/video/fb/vga.c:855-859",
    "sys/kern/subr_bus.c:2693-2711"
  ],
  "poc_changes": "No seeded PoC existed; authored an introspection harness (introspect.sh/run.sh) capturing the live claim mechanism as the baseline; the failure branch is documented by source trace in VERDICT.md since it needs VGA-less BIOS hardware.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 95,
  "guest_dirty": 0,
  "build_cmd": "./build.sh (none required)",
  "run_cmd": "./run.sh  (vm.sh run_root introspection: dmesg + devinfo -rv + ls /dev/vga*)",
  "code_hash": "",
  "notes": "Severity Low (CWE-772/CWE-401): trigger is BIOS-boot-without-VGA-decode or any vga_attach_unit failure; impact is permanent orphaned rman claims of both legacy VGA windows (resource-starvation DoS, narrow) + leaked cdev under FB_INSTALL_CDEV (LINT-only, root/wheel 02660). No unprivileged trigger, no memory corruption. Checklist cross-refs: probe-claims-success-on-absent-hardware lives in vga.c (vga.c:846-852); this finding owns the vga_isa.c unwinding half. DF-5467-class (ROM teardown) does NOT exist here: vga_isa.c maps/unmaps nothing and has no detach at all.",
  "recommended_fix": "Check both bus_alloc_resource() returns and bus_release_resource() them on vga_attach_unit() failure; destroy_dev() on fb_attach() failure (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (patch -p1 dry-run OK) implementing the unwind; kernel-rebuild validation not performed: no memory corruption reproduced (contract mandates rebuild validation only then) and the fixed failure branch is untriggerable on this rig for the same hardware-absence reason as the baseline (rigs Bochs VGA always verifies; vm.sh QEMU args are fixed, no -vga none control).",
  "fix_evidence": "findings/poc/DF-5590/fix.diff (unified diff vs sys/bus/isa/vga_isa.c, dry-run applied clean)"
}