# DF-5606 — `sys/bus/u4b/net/ruephy.c` is an unbuildable FreeBSD-API orphan

**Severity:** Info (dead code / maintenance hazard carrying latent family defects)
**File:** `sys/bus/u4b/net/ruephy.c` (232 LOC) + its header `sys/bus/u4b/net/ruephyreg.h`

## What this is

A FreeBSD-HEAD snapshot of the RTL8150 internal-PHY miibus driver, dropped into
`sys/bus/u4b/net/` (rue(4) glue that was never ported — there is no `if_rue.c`
anywhere in this tree). It is **doubly dead**:

1. **No build target references it.** Not in `sys/conf/files`, not in
   `sys/bus/u4b/net/Makefile` SUBDIR (aue axe axge cdce cue ipheth kue mos udav
   uether urndis), not in any module Makefile. The ruephy that IS compiled is a
   different, DragonFly-native copy: `sys/dev/netif/mii_layer/ruephy.c`
   (`sys/conf/files:1094`) — itself dormant (DF-5090: no "rue" NIC exists).
2. **It cannot compile against this tree.** Its include layout
   (`<dev/mii/mii.h>` :47, `<dev/usb/net/ruephyreg.h>` :51) does not exist here,
   and even with the includes granted (mapped onto DragonFly's real production
   mii headers), the source references a different mii API generation:
   `mii_phy_detach` :62, `MII_PHY_END` :87, `struct mii_phy_funcs` :90,
   `mii_phy_dev_probe` :102, `mii_phy_dev_attach`+`MIIF_NOMANPAUSE` :110,
   `mii_phy_setmedia` :132, `PHY_RESET`/`PHY_STATUS` :163/:170,
   1-arg `mii_phy_auto` :164 — none exist or differ in
   `sys/dev/netif/mii_layer`.

## Why it matters

* Audit/review noise: it looks like reachable attack surface (it is not).
* Latent carriers: if it ever were revived together with the FreeBSD new-mii
  core, it would reintroduce the family defects — the DF-5001 empty-media
  attach-panic branch and the unguarded `ifm_cur` derefs at `ruephy.c:145`
  (MII_TICK) and `ruephy.c:231` (status decode when autoneg is off).
* Its presence invites a bad copy-paste source for future u4b PHY glue.

## Evidence in this pack

* `proof.sh` / `proof.log` — host-side static proof (build-target absence,
  include-layout absence, API-symbol absence, API-delta table with cites).
* `build.sh` / `setup.sh` — guest production-code KLD rig (3 stages):
  * **S0 control:** the production twin `mii_layer/ruephy.c` builds cleanly
    through the same rig → rig is sound (`build_s0.log`).
  * **S1 verbatim:** the orphan dies at `ruephy.c:47:10: fatal error:
    dev/mii/mii.h` (`build_s1.log`).
  * **S2 includes granted:** with `<dev/mii/*>`/`<dev/usb/net/ruephyreg.h>`
    mapped onto DragonFly's unmodified production headers, the compile still
    fails on **8 distinct API symbols** — gcc even suggests the DragonFly
    replacements ("did you mean 'mii_phy_set_media'?", …) (`build_s2.log`).
* `rig_run.log` — the full rig console output (all checks green, exit 0).

## Reproduce

In the guest (`/root/df5606`, populated by this pack):

    sh setup.sh   # verbatim copies from the guest's own /usr/src
    sh build.sh   # S0 must build; S1/S2 must fail exactly as summarized

Host side, from the repo root:

    sh findings/poc/DF-5606/proof.sh

## Fix

Delete `sys/bus/u4b/net/ruephy.c` and `sys/bus/u4b/net/ruephyreg.h`
(`fix.diff`). Also called for by DF-5090's recommended fix for the twin.