{
  "finding_id": "DF-5598",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ichsmb_pci.c:175 wires device_detach to ichsmb_detach(), which ignores device_delete_child()s return (ichsmb.c:689) before the unconditional ichsmb_release_resources() + lockuninit() + return 0 -- the DF-5544/5545/5562 family shape. But unlike uhci/xhci/ohci, every deterministic veto in the ichsmb subtree is caught one level up: ichsmb_detach CHECKS bus_generic_detach() (ichsmb.c:686) and smbus_detach checks its own cascade (smbus.c:110-112), the only leaf smb_detach() never vetoes (smb.c:147-155), and the second-phase device_detach inside device_delete_child is a no-op for already-detached devices (subr_bus.c:2136-2137; DS_BUSY dead -- no device_busy() callers in the smbus subtree). Proven live on the q35+ipmi-bmc-sim rig (real ICH9 82801I): with a KLD veto child (EBUSY) under smbus0, kldunload ichsmb honestly fails Device busy, ichsmb0 stays attached with irq 16 + IO 0x700-0x73f fully intact, no panic -- the exact opposite of DF-5544s swallowed veto + freed softc + fatal page fault. After disarming, the unload completes cleanly. Residual exposure of the unchecked call: a driver kldloaded onto the smbus bus racing the kldunload (root-vs-root) between the checked generic detach and device_delete_child, or a future vetoing smbus-bus driver; hence Info hardening, not a reachable memory-safety bug.",
  "exploit_chain": "",
  "evidence": "run.log (kldunload rc=1 Device busy, devinfo -r shows ichsmb0 irq 16 + 0x700-0x73f intact after the vetoed attempt, clean rc=0 after hw.df5598_armed=0); dmesg tail in run.log (smb1/smb0 detached -> df5598veto0: DETACH VETO: returning EBUSY -> abort; then cooperating -> detached -> smbus0: detached -> ichsmb0: detached); veto.c/build.sh/run.sh harness; VERDICT.md for the full code-level veto-propagation analysis",
  "kernel_refs": [
    "sys/bus/smbus/ichsmb/ichsmb_pci.c:175",
    "sys/bus/smbus/ichsmb/ichsmb.c:686",
    "sys/bus/smbus/ichsmb/ichsmb.c:689",
    "sys/bus/smbus/ichsmb/ichsmb.c:690",
    "sys/bus/smbus/smbus.c:110",
    "sys/dev/smbus/smb/smb.c:147",
    "sys/kern/subr_bus.c:1284",
    "sys/kern/subr_bus.c:1292",
    "sys/kern/subr_bus.c:2136"
  ],
  "poc_changes": "Adapted the proven DF-5544 veto harness: (1) parent bus is smbus (child = grandchild of ichsmb0) instead of uhci; (2) no kernel thread needed -- stock kldunload ichsmb is the devclass_delete_driver() trigger (the DF-5544 thread existed only to dodge the sysctl-lock deadlock of a direct device_detach() call); (3) -Werror fixes: dropped volatile on the sysctl-backed int, added <bus/smbus/smbconf.h> for the MODULE_DEPEND version macros.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 1380,
  "guest_dirty": 0,
  "build_cmd": "cd /root/df5598 && make KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC",
  "run_cmd": "sh /root/df5598/run.sh",
  "code_hash": "d1ad25103d03df0887b5caf9d43be35a5bc2ec977a3e1c3954bee0549b66e55f",
  "notes": "Collateral observed in run.log: a VETOED unload still detaches smb0/smb1 first (devfs /dev/smb* removed; smbmsg then fails), i.e. the SMBus userland interface stays dead until a successful retry -- generic newbus non-transactional detach, same retry later posture the family fix embraces; recorded, not filed. Pass-2 negatives in VERDICT.md: no revision dispatch to attack (DID-only match, ichsmb_pci.c:211); ICH_HOSTC write at ichsmb_pci.c:255 clobbers SMB_SMI_EN/I2C_EN and is never restored on failed attach nor disabled on detach (no shutdown method) -- Info-grade notes; attach unwind sound at the PCI level (ichsmb_attach unwinding bugs are DF-5460s, not re-reported); RF_SHAREABLE IRQ handler is spurious-safe (ichsmb.c:509-518); probe table walk bounded; duplicate ICH7/8/9 rows cosmetic.",
  "recommended_fix": "Check and propagate device_delete_child()s return at ichsmb.c:689 before ichsmb_release_resources(), so a second-phase child-deletion failure leaves IRQ/IO/softc fully intact and the caller retries (matches the validated DF-5544/5545/5562 family fix).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "No reproducible bad behavior exists to A/B (the findings substance is that the deterministic family failure does NOT reach the teardown); fix.diff is the trivial 3-line check+propagate identical in shape to the already-validated DF-5544/5545/5562 fixes and is supplied for review completeness.",
  "fix_evidence": "fix.diff; family precedent run.fix.log in findings/poc/DF-5544/"
}