# DF-5642 — `smbus_attach` unconditionally re-creates the whole child set on every attach → unbounded child leak + duplicate `/dev/smbN[-XX]` nodes on one bus

* File under audit: `sys/bus/smbus/smbus.c` (pass 2)
* Class: resource leak / device-topology corruption (DF-5633 twin at the smbus layer)
* Severity: Low (root-gated: kldunload/kldload of a bridge with surviving children, rescan/rebind)
* Verdict: **REPRODUCED** (4→44 children after 10 cycles, +4/cycle; `/dev/smb*`
  4→44; duplicate forced-slave nodes with corrupted address encoding), fix
  validated (children constant across cycles on the patched kernel)

## The defect

`smbus_attach` (`smbus.c:94-97`) populates the bus unconditionally:

```c
device_add_child(dev, NULL, device_get_unit(dev));      /* generic smb child */
for (addr = 16; addr < 112; ++addr)
        smbus_probe_device(dev, addr);                  /* per-address smb children */
```

with no re-creation guard, while `smbus_detach` (`smbus.c:105-115`) only
runs `bus_generic_detach` and never deletes the children. Children survive
every teardown path:

* `devclass_delete_driver` (the kldunload path, `subr_bus.c:888-897`)
  detaches devices but never deletes them;
* the DF-5633-class asymmetric bridge detach: `viapm_586b_detach`
  (`viapm.c:423-430`) detaches the shared-attach `smbus` child
  (`viapm.c:362`) but only deletes `iicbb`;
* any rescan/rebind that detaches and re-attaches the smbus device.

Every later `device_probe_and_attach(smbus0)` (exactly what
`bus_generic_driver_added`, `subr_bus.c:3012-3015`, does on driver
re-registration) re-runs `smbus_attach` and mints a **second full child
set**:

* +1 `struct bsd_device` (generic child) + one per responding address
  (probe loop) per cycle, unbounded (M_BUS leak, ~0x2c0 bytes each);
* the new children take **remapped** units (`devclass_alloc_unit`,
  `subr_bus.c:1072-1081`), so each cycle mints duplicate `/dev/smbN[-XX]`
  character devices on ONE physical bus — e.g. the second copy of the
  address-0x10 probe child lands at unit 1041 and is exposed as
  `/dev/smb0-11`, whose ioctl path (`smb.c:229-231`) then **forces slave
  address 0x11 — an address nothing responds on**: the node-name ↔
  physical-address contract (`smb.c:134-141`, `cyapa.c:466-472`) is
  corrupted.

## Reproduction (guest, stock kernel + production-code KLD rig)

Family-standard rig (`df5642_rig.c`): a fake SMBus controller on nexus
registers the **real in-kernel `smbus` driver** (`DRIVER_MODULE(smbus,
fakesmbb, smbus_driver, ...)`, mirroring `intpm.c:903`) and creates
`smbus0` exactly like `intpm.c:331-337`. The emulated controller answers
addresses 0x10/0x50/0x67, so each attach mints 1 generic + 3 probe
children, claimed by the real in-kernel `smb` driver → real
`make_dev` nodes.

`run_a.sh` / `run_a2.log` — production APIs only
(`device_detach(smbus0)` + `device_probe_and_attach(smbus0)`):

```
[df5642] attach: nchildren=4                      (smb0 + smb1040/1104/1127)
node_count= 4                                     (/dev/smb0 smb0-10 smb0-50 smb0-67)
[df5642] after-cycle: nchildren=8                 (+4 per cycle, deterministic)
[df5642] after-cycle: nchildren=44                (10 cycles)
FINAL_node_count= 44
/dev/smb0 ... smb0-11 smb0-12 smb0-13 ... smb1 smb2 smb3 ...  (duplicates)
```

Each cycle's new probe children land on remapped units (1041..) →
duplicate `smb0-XX` nodes whose `-XX` no longer names the address they
probed.

## Fix (validated)

`fix.diff` populates the bus only when it has no children yet
(`device_get_children` guard in `smbus_attach`). On the patched kernel
(`run_a_fixed.log`): nchildren stays 4 across cycles, node count stays 4.