{
  "finding_id": "DF-5616",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Live-verified on the QEMU/i440fx guest: icu_ioapic_extint(-1, 0x20) is ACCEPTED (returns 0) because the guard at icu.c:167 (irq >= 8 || irq == 2) lacks the signed lower bound, executes the C-undefined shift 1 << irq at icu.c:170 (materializes as 1 << 31 on this target), and writes IMR1 = 0xff (all-masked, benign) to the live master 8259 at icu.c:180 without imen_spinlock and without syncing icu_imen. Nothing corrupts: the mask truncates to 0xff, the shadow is untouched, state restores exactly, guest stays healthy. Only in-tree caller pins irq==0 via always-on KKASSERT (ioapic_abi.c:1064); kernel-code-only reach (root/KLD). Info/hardening; two-token fix.",
  "exploit_chain": "",
  "evidence": "run.log P4 lines: icu_ioapic_extint(-1,0x20)=0 IMR1_after=0xff ... shadow_untouched=YES and restored IMR={fb,ff} want={fb,ff}; P3 (uint8_t)~(1 << -1) = 0xff; D1/P6 icu_imen=fffb hw=fffb coherent=YES; VERDICT.md carries the full pass-2 negative results (IMEN SMP protocol correct, ELCR persistence proven live, boot-order proofs killing the cleanup/KKASSERT race candidates, dead icu_reinit/elcr_resume).",
  "kernel_refs": [
    "sys/platform/pc64/icu/icu.c:167",
    "sys/platform/pc64/icu/icu.c:170",
    "sys/platform/pc64/icu/icu.c:176",
    "sys/platform/pc64/icu/icu.c:180",
    "sys/platform/pc64/apic/ioapic_abi.c:1064",
    "sys/platform/pc64/apic/ioapic_abi.c:1073"
  ],
  "poc_changes": "Authored harness from scratch (no seed). v1 pinned to CPU0 via lwkt_setcpu_self() and panicked the guest afterwards in dfly_acquire_curproc (usched_dfly.c:453) \u2014 a HARNESS bug (out-of-contract primitive use), documented in panic.txt, not a finding. v2 dropped the pinning and replaced the icu_definit()-based restore (would KKASSERT-panic under the live IOAPIC ABI, icu.c:109) with a manual ICW sequence mirroring icu_init() (icu.c:62-102).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 210,
  "guest_dirty": 0,
  "build_cmd": "cd /root/icuintro && sh build.sh   (bsd.kmod.mk; cc -Werror clean -> icuintro.ko)",
  "run_cmd": "cd /root/icuintro && sh run.sh      (kldload ./icuintro.ko; dmesg tail; kldunload)",
  "code_hash": "36a8dcd2bfe8c9935c4d32640997bd91435fe6b7d6d5b8428ffbcd98b7624822",
  "notes": "Impact honestly none (that IS the Info classification): no unprivileged reach, no OOB, no wild write; worst-case x86 materialization of the UB is mask=0xff == the value icu_init writes deliberately (icu.c:83). Pass-2 cross-checks: no DF-5464-class INVARIANTS-only KASSERT exists in icu.c (its KKASSERTs at icu.c:109/190/191 provably hold at every call site); icu.c never calls msi_setup/msi_map (DF-1102 consumers are in icu_abi.c, covered by DF-5466); icu_reinit (icu.c:127) and elcr_resume are dead code \u2014 acpi_sleep_machdep is a stub (acpi_wakeup.c:50-54), so icu_init never runs post-boot and the theoretical SMP window on its lockless IMR writes is unreachable. Live data also proves ELCR persists across mask cycles and full ICW reprograms (kills the trigger-mode-persistence concern on this platform) and icu_imen==IMR coherence under the mask protocol.",
  "recommended_fix": "Add the signed lower bound: if (irq < 0 || irq >= 8 || irq == 2) return EOPNOTSUPP; (icu.c:167)",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Info/hardening finding \u2014 single-fix kernel rebuild not warranted. fix.diff is a two-token guard whose entire behavioral delta is return EOPNOTSUPP for irq < 0, verified against the live P4 result by inspection; no memory-corruption baseline exists to regression-test.",
  "fix_evidence": "fix.diff"
}