# VERDICT — DF-5606: `sys/bus/u4b/net/ruephy.c` is an unbuildable FreeBSD-API orphan

**Bottom line:** Not a memory-safety defect in itself. The file is a
FreeBSD-HEAD snapshot of the RTL8150 miibus PHY glue whose consumer (rue(4),
`if_rue.c`) was never ported to DragonFly; it is referenced by **no build
target** in the tree and **cannot compile** against DragonFly's mii API even
when deliberately wired up and granted its FreeBSD include layout. Every
latent defect it carries is therefore unreachable on any kernel buildable
from this tree. Removal is the fix; DF-5090 (filed on the compiled twin
`sys/dev/netif/mii_layer/ruephy.c`) already recommends deleting this pair.

## Pass-2 analysis (family checklist)

### (a) miibus methods — register reads, status decode, media tables
The only "device-supplied bits feeding indexes" surface would be
`ruephy_status` (`ruephy.c:191-232`): MSR/BMCR/BMSR bits (read twice and OR'd
— correct latched-bit idiom, :201/:212) are mapped to **fixed IFM_*
constants** (:220-229); no array index, no table lookup, no length. The only
table in the file, `ruephys[]` (:85-88), is properly terminated by
`MII_PHY_END`. `ifm_cur->ifm_media` at :231 is user-validated by the ifmedia
framework (SIOCSIFMEDIA), semantic-only. **No OOB primitive exists here.**

### (b) ifmedia table construction
Not in this file — media entries are added by the mii core
(`mii_phy_dev_attach(..., 1)` in FreeBSD's API). The empty-capability edge
(BMSR_MEDIAMASK == 0 over USB → empty media list) is the DF-4930/DF-5001
family panic, owned by the hub finding.

### (c) attach/detach vs miibus probing
No file-local softc state beyond `struct mii_softc`; attach is one core call
(:110-111), detach is core-provided (:62). The DF-5394-style probe/attach
race surface lives in the NIC-side plumbing (`usb_ethernet.c:232`
`mii_phy_probe` during `ue_attach`, `:288-290` detach) — owned by the
DF-5493..5495 family. **No file-local race.** The probe gate
(:100-103: grandparent must be named "rue") additionally can never pass — no
such driver exists (DF-5090 proof, sections A-C).

### (d) rue(4)-supplied data
PHY_READ results flow only into bit tests and the IFM decode above. The
double-read at :153-154 handles latched-low link bits. **Nothing feeds a
length, index, or pointer.**

### Latent defects the orphan would carry if ever revived with the FreeBSD new-mii core
- `ruephy.c:145` — `IFM_SUBTYPE(ife->ifm_media)` in MII_TICK with `ifm_cur`
  taken at :118 unguarded (NULL only via the empty-media path that panics
  first in the family scenario).
- `ruephy.c:231` — same pattern in the non-autoneg status branch.
- DF-5001 empty-media attach-panic branch via `mii_phy_dev_attach(..., 1)`.

## Verification (Phase V) — production-code KLD rig on the guest

Guest: DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC, built Jul 2 2026), gcc
8.3 [DragonFly]. Guest `/usr/src/sys/bus/u4b/net/ruephy.c` md5-identical to
the audited repo file (`83e5d308f4967b9d48494c1732aef59f`), re-verified by
cksum inside the rig run.

- **S0 control** (`build_s0.log`): the production twin
  `sys/dev/netif/mii_layer/ruephy.c`, copied verbatim, builds cleanly through
  the same KLD rig → the rig itself is sound.
- **S1 verbatim orphan** (`build_s1.log`): dies at
  `ruephy.c:47:10: fatal error: dev/mii/mii.h: No such file or directory`
  (FreeBSD include layout; `sys/dev/mii` and `sys/dev/usb` do not exist in
  DragonFly).
- **S2 includes granted** (`build_s2.log`): with `<dev/mii/mii.h>`,
  `<dev/mii/miivar.h>`, `<dev/usb/net/ruephyreg.h>` resolved to DragonFly's
  unmodified production headers (fakeinc, cksums in `rig_run.log`), the
  compile **still fails on 8 distinct API symbols**:
  `mii_phy_detach` :62, `MII_PHY_END` :87, `struct mii_phy_funcs` :90,
  `mii_phy_dev_probe` :102, `mii_phy_dev_attach` + `MIIF_NOMANPAUSE` :110,
  `mii_phy_setmedia` :132, `PHY_RESET`/`PHY_STATUS` :163/:170, 1-arg
  `mii_phy_auto` :164. GCC's own suggestions spell out the generation gap
  ("did you mean 'mii_phy_set_media'?", "did you mean 'mii_phy_probe'?").
- Host static proof (`proof.log`): zero build-target references; include
  layout absent; API symbols absent from `sys/dev/netif/mii_layer` (only
  in-tree vestiges: `atphy.c:89` inside `#if 0`, `atphy.c:99/:114` comments).

Nothing was kldload'ed; `/usr/src` untouched; guest never panicked.

## Attempts

1. First rig run: stages mis-evaluated — my `-I` rode `CFLAGS+=`, which
   `sys/conf/kmod.mk:98` rebuilds with a plain `=` (`CFLAGS=
   ${COPTFLAGS} ${KCFLAGS} ${COPTS} ...`), so the granted includes never
   reached cc, and the S1 grep pattern assumed gcc quote style while the
   actual message is clang/gcc-8 caret style. Control S0 already built OK.
2. Second rig run: `COPTS+= -I...` (kmod.mk:108-109 preserves -I* past
   `-nostdinc`), grep patterns fixed → all three stages exactly as
   predicted, rig exit 0.

## Fix

`fix.diff` deletes `sys/bus/u4b/net/ruephy.c` and
`sys/bus/u4b/net/ruephyreg.h` (git-apply-able, verified with
`git apply --check`). No runtime behavior changes: nothing references them.
Fix validation is not applicable — there is no baseline runtime behavior of
dead code to compare against.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.