{ "finding_id": "DF-5606", "status": "not_reproduced", "reproduced": false, "impact": "none", "confidence": "certain", "verdict": "Pass-2 audit of sys/bus/u4b/net/ruephy.c: the file is a FreeBSD-HEAD snapshot of the RTL8150 miibus PHY glue whose consumer rue(4) (if_rue.c) was never ported to DragonFly, and it is doubly dead. (1) No build target references it -- absent from sys/conf/files, from sys/bus/u4b/net/Makefile SUBDIR, and from every module Makefile (host proof.log section A); the ruephy that compiles is the DragonFly-native twin sys/dev/netif/mii_layer/ruephy.c (sys/conf/files:1094), itself dormant per DF-5090 (no NIC named rue exists, so the orphans probe gate at ruephy.c:100-103 can never pass either). (2) It cannot compile against this tree even when deliberately wired up: verbatim build dies at ruephy.c:47 dev/mii/mii.h: No such file or directory (FreeBSD include layout; S1), and with the includes granted -- mapped onto DragonFlys unmodified production mii headers -- the compile still fails on 8 distinct API symbols (S2: mii_phy_detach :62, MII_PHY_END :87, struct mii_phy_funcs :90, mii_phy_dev_probe :102, mii_phy_dev_attach + MIIF_NOMANPAUSE :110, mii_phy_setmedia :132, PHY_RESET/PHY_STATUS :163/:170, 1-arg mii_phy_auto :164), while the S0 control (the production twin through the identical rig) builds cleanly, proving the rig sound. The latent defects the orphan carries (unguarded ifm_cur derefs at :145/:231, the DF-5001 empty-media attach-panic branch) are therefore unreachable on every kernel buildable from this tree; they only revive if FreeBSDs whole new-mii core is imported alongside. No runtime manifestation exists to reproduce; the rig confirmed the dead-code disposition exactly as predicted.", "exploit_chain": "", "evidence": "findings/poc/DF-5606/build_s2.log (gcc errors at ruephy.c:62/87/90/102/110/132/163/164/170 with did you mean mii_phy_set_media / mii_phy_probe suggestions -- the API generation gap, compiler-attested); build_s1.log:63 (ruephy.c:47 fatal include error); build_s0.log (control twin builds, rig sound); rig_run.log (all rig checks green, cksums proving verbatim production sources, RIG VERDICT unbuildable); proof.log (host static proof A-D); fix.diff (verified git-apply-able deletion of the orphan pair).", "kernel_refs": [ "sys/bus/u4b/net/ruephy.c:47", "sys/bus/u4b/net/ruephy.c:51", "sys/bus/u4b/net/ruephy.c:62", "sys/bus/u4b/net/ruephy.c:87", "sys/bus/u4b/net/ruephy.c:90", "sys/bus/u4b/net/ruephy.c:100", "sys/bus/u4b/net/ruephy.c:102", "sys/bus/u4b/net/ruephy.c:110", "sys/bus/u4b/net/ruephy.c:132", "sys/bus/u4b/net/ruephy.c:145", "sys/bus/u4b/net/ruephy.c:164", "sys/bus/u4b/net/ruephy.c:231", "sys/bus/u4b/net/Makefile", "sys/conf/files:1094", "sys/dev/netif/mii_layer/miivar.h:260", "sys/dev/netif/mii_layer/miivar.h:270", "sys/dev/netif/mii_layer/miivar.h:276", "sys/dev/netif/mii_layer/atphy.c:89", "sys/bus/u4b/net/usb_ethernet.c:232", "sys/conf/kmod.mk:98" ], "poc_changes": "No seed PoC existed (pass-2 finding authored with its own evidence). Rig iterated once: the granted-include -I originally rode CFLAGS+= which sys/conf/kmod.mk:98 wipes with a plain = assignment (rebuilt from COPTFLAGS/KCFLAGS/COPTS), so it never reached cc; moved to COPTS+= (kmod.mk:108-109 preserves -I* past -nostdinc) and relaxed the S1 expectation grep from gcc-quoted to the actual caret-style diagnostic.", "attempts": 2, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64", "runtime_sec": 410, "guest_dirty": 0, "build_cmd": "guest: cd /root/df5606 && sh setup.sh && sh build.sh (KLD rig: make -m /usr/src/share/mk in obj0/obj1/obj2; nothing kldloaded)", "run_cmd": "guest: sh /root/df5606/build.sh -> exit 0 with RIG VERDICT: orphan ruephy.c is UNBUILDABLE on this tree; host: sh findings/poc/DF-5606/proof.sh -> PROOF OK", "code_hash": "94c8be037fefb7ab286bc4381b81583b0fcd5ceb76173d28590c84b5c2f91e4f", "notes": "Pass-2 family checklist hunted and killed with cites: (a) miibus status decode maps device bits to fixed IFM_* constants (ruephy.c:220-229), double-read OR idiom correct (:153-154, :201, :212), no index/table/length anywhere -- no OOB primitive; (b) media table built by mii core, files own ruephys[] table properly MII_PHY_END-terminated (:85-88); empty-capability edge is the DF-4930/DF-5001 family hub; (c) no file-local state beyond mii_softc, attach/detach are core calls (:110/:62), probe race surface owned by usb_ethernet.c:232/:288-290 (DF-5493..5495); (d) PHY_READ values feed only bit tests. Latent ifm_cur derefs at :145/:231 are triple-gated (file unbuildable + no rue parent + DF-5001 panic fires first). Related: DF-5090 (twin, filed the family dead-code leaf), DF-5001 (empty-media hub), DF-1973/DF-5009 (service KASSERT family). The single finding deliberately does NOT re-file the family leaves against this file -- they are unreachable here a fortiori.", "recommended_fix": "Delete the orphaned FreeBSD snapshot pair sys/bus/u4b/net/ruephy.c and sys/bus/u4b/net/ruephyreg.h (fix.diff); if rue(4)/new-mii is ever imported, land the DF-5001 miibus_mediainit guard in the same commit.", "fix_status": "not_applicable", "fix_baseline_reproduced": 0, "fix_patched_reproduced": 0, "fix_verdict": "Not applicable: the finding is dead code whose remedy is deletion. There is no baseline runtime behavior (the file cannot compile or load on any kernel from this tree), so no baseline-vs-patched comparison exists; the deletion diff itself is verified with git apply --check.", "fix_evidence": "findings/poc/DF-5606/fix.diff (deletes sys/bus/u4b/net/ruephy.c + ruephyreg.h; applies cleanly); rig_run.log S1/S2 show the file cannot reach a compiler pass, hence nothing observable changes post-fix." }