{
  "finding_id": "DF-5606",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Pass-2 audit of sys/bus/u4b/net/ruephy.c: the file is a FreeBSD-HEAD snapshot of the RTL8150 miibus PHY glue whose consumer rue(4) (if_rue.c) was never ported to DragonFly, and it is doubly dead. (1) No build target references it -- absent from sys/conf/files, from sys/bus/u4b/net/Makefile SUBDIR, and from every module Makefile (host proof.log section A); the ruephy that compiles is the DragonFly-native twin sys/dev/netif/mii_layer/ruephy.c (sys/conf/files:1094), itself dormant per DF-5090 (no NIC named rue exists, so the orphans probe gate at ruephy.c:100-103 can never pass either). (2) It cannot compile against this tree even when deliberately wired up: verbatim build dies at ruephy.c:47 dev/mii/mii.h: No such file or directory (FreeBSD include layout; S1), and with the includes granted -- mapped onto DragonFlys unmodified production mii headers -- the compile still fails on 8 distinct API symbols (S2: mii_phy_detach :62, MII_PHY_END :87, struct mii_phy_funcs :90, mii_phy_dev_probe :102, mii_phy_dev_attach + MIIF_NOMANPAUSE :110, mii_phy_setmedia :132, PHY_RESET/PHY_STATUS :163/:170, 1-arg mii_phy_auto :164), while the S0 control (the production twin through the identical rig) builds cleanly, proving the rig sound. The latent defects the orphan carries (unguarded ifm_cur derefs at :145/:231, the DF-5001 empty-media attach-panic branch) are therefore unreachable on every kernel buildable from this tree; they only revive if FreeBSDs whole new-mii core is imported alongside. No runtime manifestation exists to reproduce; the rig confirmed the dead-code disposition exactly as predicted.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5606/build_s2.log (gcc errors at ruephy.c:62/87/90/102/110/132/163/164/170 with did you mean mii_phy_set_media / mii_phy_probe suggestions -- the API generation gap, compiler-attested); build_s1.log:63 (ruephy.c:47 fatal include error); build_s0.log (control twin builds, rig sound); rig_run.log (all rig checks green, cksums proving verbatim production sources, RIG VERDICT unbuildable); proof.log (host static proof A-D); fix.diff (verified git-apply-able deletion of the orphan pair).",
  "kernel_refs": [
    "sys/bus/u4b/net/ruephy.c:47",
    "sys/bus/u4b/net/ruephy.c:51",
    "sys/bus/u4b/net/ruephy.c:62",
    "sys/bus/u4b/net/ruephy.c:87",
    "sys/bus/u4b/net/ruephy.c:90",
    "sys/bus/u4b/net/ruephy.c:100",
    "sys/bus/u4b/net/ruephy.c:102",
    "sys/bus/u4b/net/ruephy.c:110",
    "sys/bus/u4b/net/ruephy.c:132",
    "sys/bus/u4b/net/ruephy.c:145",
    "sys/bus/u4b/net/ruephy.c:164",
    "sys/bus/u4b/net/ruephy.c:231",
    "sys/bus/u4b/net/Makefile",
    "sys/conf/files:1094",
    "sys/dev/netif/mii_layer/miivar.h:260",
    "sys/dev/netif/mii_layer/miivar.h:270",
    "sys/dev/netif/mii_layer/miivar.h:276",
    "sys/dev/netif/mii_layer/atphy.c:89",
    "sys/bus/u4b/net/usb_ethernet.c:232",
    "sys/conf/kmod.mk:98"
  ],
  "poc_changes": "No seed PoC existed (pass-2 finding authored with its own evidence). Rig iterated once: the granted-include -I originally rode CFLAGS+= which sys/conf/kmod.mk:98 wipes with a plain = assignment (rebuilt from COPTFLAGS/KCFLAGS/COPTS), so it never reached cc; moved to COPTS+= (kmod.mk:108-109 preserves -I* past -nostdinc) and relaxed the S1 expectation grep from gcc-quoted to the actual caret-style diagnostic.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 410,
  "guest_dirty": 0,
  "build_cmd": "guest: cd /root/df5606 && sh setup.sh && sh build.sh   (KLD rig: make -m /usr/src/share/mk in obj0/obj1/obj2; nothing kldloaded)",
  "run_cmd": "guest: sh /root/df5606/build.sh  -> exit 0 with RIG VERDICT: orphan ruephy.c is UNBUILDABLE on this tree; host: sh findings/poc/DF-5606/proof.sh -> PROOF OK",
  "code_hash": "94c8be037fefb7ab286bc4381b81583b0fcd5ceb76173d28590c84b5c2f91e4f",
  "notes": "Pass-2 family checklist hunted and killed with cites: (a) miibus status decode maps device bits to fixed IFM_* constants (ruephy.c:220-229), double-read OR idiom correct (:153-154, :201, :212), no index/table/length anywhere -- no OOB primitive; (b) media table built by mii core, files own ruephys[] table properly MII_PHY_END-terminated (:85-88); empty-capability edge is the DF-4930/DF-5001 family hub; (c) no file-local state beyond mii_softc, attach/detach are core calls (:110/:62), probe race surface owned by usb_ethernet.c:232/:288-290 (DF-5493..5495); (d) PHY_READ values feed only bit tests. Latent ifm_cur derefs at :145/:231 are triple-gated (file unbuildable + no rue parent + DF-5001 panic fires first). Related: DF-5090 (twin, filed the family dead-code leaf), DF-5001 (empty-media hub), DF-1973/DF-5009 (service KASSERT family). The single finding deliberately does NOT re-file the family leaves against this file -- they are unreachable here a fortiori.",
  "recommended_fix": "Delete the orphaned FreeBSD snapshot pair sys/bus/u4b/net/ruephy.c and sys/bus/u4b/net/ruephyreg.h (fix.diff); if rue(4)/new-mii is ever imported, land the DF-5001 miibus_mediainit guard in the same commit.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Not applicable: the finding is dead code whose remedy is deletion. There is no baseline runtime behavior (the file cannot compile or load on any kernel from this tree), so no baseline-vs-patched comparison exists; the deletion diff itself is verified with git apply --check.",
  "fix_evidence": "findings/poc/DF-5606/fix.diff (deletes sys/bus/u4b/net/ruephy.c + ruephyreg.h; applies cleanly); rig_run.log S1/S2 show the file cannot reach a compiler pass, hence nothing observable changes post-fix."
}