{
  "finding_id": "DF-5634",
  "status": "reproduced",
  "verdict": "REPRODUCED: iicbus children are created with no struct iicbus_ivar ever allocated and no bus_child_detached to free one (iicbus.c:144-146,164-171 -- the DF-5559 root-cause file). Stock: BUS_WRITE/READ_IVAR -> ENXIO with the result variable untouched (the DF-5559 uninit class seen from the provider side). Even with DF-5559s validated accessor fix applied, every child still has ivar==NULL, so iicbus_write_ivar returns success while discarding the value (write 0x42 -> read 0x0, forever): the official interface can never store a child address. fix.diff allocates ivars in the corrected bus_add_child and frees them in a new bus_child_detached; fixed module round-trips 0x42.",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "run_b_5559.log + dmesg witness ([df5632] IVAR_RT: WRITE_IVAR(0x42) error=0 then READ_IVAR error=0 val=0x0 iicbus_get_addr=0x0 -- silent drop with the DF-5559 fix loaded); stock witness in ../DF-5632/run_a2.log (IVAR_RT: WRITE error=6, READ val=0x42424242 untouched); fixed witness in ../DF-5632/run_d_fixed.log (dfctl ivar: v1=0x42 v2=0x42)",
  "kernel_refs": [
    "sys/bus/iicbus/iicbus.c:144-146",
    "sys/bus/iicbus/iicbus.c:164-171",
    "sys/bus/iicbus/iicbus.c:59-73",
    "sys/bus/iicbus/iicbus.h:44-56"
  ],
  "poc_changes": "IVAR_RT ioctl in the ../DF-5632 rig drives production BUS_WRITE_IVAR/BUS_READ_IVAR/iicbus_get_addr on a real iicbus child; baseline uses iicbus.ko rebuilt with DF-5559s own validated fix.diff to isolate the silent-drop delta.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 600,
  "guest_dirty": 0,
  "build_cmd": "sh /root/df5632/build.sh (mod_5559 = stock + DF-5559 fix; mod_fixed = stock + fix.diff)",
  "run_cmd": "sh /root/df5632/run_b_5559.sh (silent-drop witness: ./dfctl ivar); sh /root/df5632/run_d_fixed.sh (fixed round trip)",
  "code_hash": "df5632_rig.c 89e5ff9630fa73906f5e0fb4b882e484dcc0014050cbfc65bc61801f8796bc03 (shared rig, ../DF-5632)",
  "notes": "Completes the 2026-10-07 task_log lead (longer term allocate iicbus_ivar for children in bus_add_child per FreeBSD). Also removes the dead DEVTOIICBUS macro (iicbus.c:44) that casts to the nonexistent struct iicbus_device. No direct memory-safety impact by itself -- the uninit-read consequence was DF-5559; this is the provider-side completion so the accessor contract actually functions.",
  "recommended_fix": "Allocate a zeroed struct iicbus_ivar in iicbus_add_child (device_set_ivars) and free it in a bus_child_detached method; keep the DF-5559 read/write_ivar accessors (fix.diff).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "With iicbus.ko rebuilt from fix.diff, the ivar round trip works on a production child: WRITE_IVAR(0x42) error=0, READ_IVAR val=0x42, iicbus_get_addr=0x42 -- the silent drop is gone and the accessor contract functions.",
  "fix_evidence": "../DF-5632/run_d_fixed.log (dfctl ivar: kernel rc=0 v0=0x0 v1=0x42 v2=0x42); ../DF-5632/run_d_fixed_dmesg.txt ([df5632] IVAR_RT: READ_IVAR error=0 val=0x42 iicbus_get_addr=0x42)"
}