# DF-5635 VERDICT — REPRODUCED (swallowed child-detach error → NULL-softc deref panic), fix validated

See README.md for the full narrative. Decisive evidence (stock, `panic_5635_stock.txt`):

```
[df5632] df5632k0 detach: REFUSING (EBUSY)
iicbus0: detached
[df5632] DETACH_BUS: device_detach(iicbus0) returned 0  (child df5632k0 busy=1)   <- THE SWALLOW
[df5632] DETACH_BUS-post: iicbus=... driver=(NONE-DRIVERLESS) state=0 softc=0     <- softc freed
[df5632] DETACH_BUS-post: child[3] devclass=df5632k unit=0 driver=df5632k state=3 <- child still attached
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x8                                    <- offsetof(iicbus_softc, owner)
Stopped at      iicbus_request_bus+0x89:  movq 0x8(%r12),%rax   <- iiconf.c:101 sc->owner
```

Fixed (`run_d_fixed.log`): `device_detach(iicbus0) returned 16 (EBUSY)`,
bus stays `driver=iicbus state=3 softc=0xfffff8008d581130`, `REQBUS:
returned 0` on the attached bus, clean unload — the inconsistent state and
the panic are gone.

DF-5563 lead answer: the iiconf drain/dying protocol DOES require this
file's detach to wake/drain waiters — DF-5563's validated fix.diff already
adds that block to iicbus_detach; this finding is the independent
swallowed-error defect at the same lines.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.