# DF-5598 — ichsmb detach-veto family residue (Info, hardening)

**File:** `sys/bus/smbus/ichsmb/ichsmb_pci.c` (pass 2)
**Class:** detach-veto family (DF-5544 / DF-5545 / DF-5562 / DF-5528 / DF-4558) — *mitigated variant*

## What this pack demonstrates

`ichsmb_pci.c:175` wires `device_detach` to `ichsmb_detach()`
(`ichsmb.c:680`), whose `device_delete_child(dev, sc->smb)` return at
`ichsmb.c:689` is ignored before the unconditional
`ichsmb_release_resources()` + `lockuninit()` + `return 0`. This is the
family shape — **but** unlike uhci/xhci/ohci, `ichsmb_detach` first runs a
*checked* `bus_generic_detach(dev)` cascade (`ichsmb.c:686`) and
`smbus_detach()` checks its own cascade (`smbus.c:110-112`).

This harness attaches a vetoing child (`EBUSY`) directly under `smbus0`
(grandchild of `ichsmb0`) and drives the exact `kldunload` path
(`linker_file_unload -> devclass_delete_driver`, `subr_bus.c:897`).

## Build (inside the guest)

```
sh build.sh        # make KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC
```

Requires: q35 rig guest (`-machine q35 -device ipmi-bmc-sim,id=bmc0 -device
smbus-ipmi,bmc=bmc0,address=0x20 -device i2c-ddc,address=0x50`),
`kldload ichsmb`, `kldload smb`.

## Run (as root, inside the guest)

```
sh run.sh
```

## Expected output

* `kldunload ichsmb` **fails** (`Device busy`) while the veto child is armed:
  `df5598veto0: DETACH VETO: returning EBUSY` on the console, and
  `devinfo -r` still shows `ichsmb0` with `I/O ports 0x700-0x73f` and
  `irq 16` — **the veto is HONORED, nothing is torn down, no panic**.
  (This is the opposite of DF-5544, where the same trigger produced
  `uhci0: detached` + return 0 + freed softc + fatal page fault.)
* Collateral observed: `smb0`/`smb1` are detached (their `/dev/smb*` nodes
  removed) before the veto surfaces — a vetoed unload leaves the SMBus
  service dead until a successful retry (generic newbus non-transactional
  detach; robustness note, not memory corruption).
* After `sysctl hw.df5598_armed=0`, `kldunload ichsmb` returns 0 and the
  whole subtree (`df5598veto0`, `smbus0`, `ichsmb0`) detaches cleanly.

## Artifacts

* `veto.c`, `Makefile` — the KLD stand-in veto child (adapted from the
  DF-5544 harness; the kernel thread is unnecessary because `kldunload`
  is a stock syscall-level trigger here).
* `build.sh`, `build.log` — build transcript.
* `run.sh`, `run.log` — full decisive run.
* `fix.diff` — check + propagate `device_delete_child()` (hardening).
* `env.txt`, `VERDICT.md`, `manifest.json`, `verdict.json`.