# DF-5637 VERDICT — REPRODUCED

**Root cause:** `smbus_release_bus()` (sys/bus/smbus/smbconf.c:151-180)
performs the parent teardown `SMBUS_CALLBACK(parent, SMB_RELEASE_BUS, NULL)`
at smbconf.c:160 **before** validating `sc->owner == dev` at smbconf.c:166,
then broadcasts `wakeup(sc)` at smbconf.c:177 even when validation fails
(EACCES). Under the iicsmb bridge the parent call is
`iicbus_release_bus(parent, iicsmb_dev)` (iicsmb.c:263-266), and because
every smbus requester funnels through the *same* iicsmb device token, the
iicbus ownership check trivially passes: **any** smbus child device_t —
owner or not — succeeds in releasing the underlying iicbus.

**Reproduced (stock kernel, same rig/chain as DF-5636):**
F3: with devA the recorded owner, a non-owner devB's `smbus_release_bus`
returned EACCES yet the iicbus had been released — the rig's direct
`iicbus_request_bus(iicbus0, devC, IIC_DONTWAIT)` probe succeeded (=0),
proving the bridge exclusion under the still-official owner was gone
(summary=0x1, run_baseline.log). F3B: the same non-owner release woke a
parked requester into a success return while `sc->owner` still equaled
devA — a grant with **no release at all** (compounding with the DF-5636
loop bug). Wedge consequence observed live: after a non-owner release tore
the bridge, the *real* owner's own release failed EACCES at the callback
and left `sc->owner` set forever, parking all subsequent requesters.

**Fixed kernel (fix.diff, kernel #3):** release validates ownership first
(EACCES without touching the bridge), and the EACCES path no longer wakes
anyone: F3 probe refused with EWOULDBLOCK (`bridge exclusion intact`),
F3B waiter stays parked until the real release (`GOOD on fixed code`),
no wedges across the whole suite.

**Not separately demonstrated:** the cross-CPU double-acquire via the
per-CPU-only `crit_enter()` sections (smbconf.c:165-174, and
smbconf.c:127-136 in request) — structurally the DF-5566 MP twin; the
window is a few instructions and the deterministic protocol bugs above
were the priority. The fix keeps the crit sections (matching the iiconf
twin's scope); a lock-based rework belongs to a family-wide cleanup.

**Classification:** status=reproduced, reproduced=1, impact=dos
(protocol teardown / permanent bus wedge / spurious wake), confidence
certain. Severity Low: requires a caller passing a wrong/non-owner
device_t (driver bug, error-path misuse, or the wedge chain above) —
root/HW-config gated, same band as the DF-5566 twin it mirrors.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.