# DF-5642 VERDICT — smbus_attach unguarded child re-creation (leak + duplicate /dev nodes)

**Status: REPRODUCED, fix validated.** Impact: dos (unbounded kernel heap
leak + duplicate/corrupted /dev/smbN[-XX] topology). Root-gated trigger.

## What was proven, on what code

The rig (`df5642_rig.c`, this pack) registers the REAL in-kernel `smbus`
driver (`DRIVER_MODULE(smbus, fakesmbb, smbus_driver, smbus_devclass, ...)`
— the same registration `intpm.c:903` performs for the PIIX4) under a fake
controller on nexus, and creates `smbus0` exactly like `intpm.c:331-337`
(`device_add_child(dev, "smbus", -1)` + `device_probe_and_attach`). The
production `smbus_attach` (`smbus.c:94-97`) then runs unmodified: it adds
the unnamed generic child and drives 96 `smbus_trans` probes against the
emulated controller (which answers 0x10/0x50/0x67), creating the
per-address children; the real `smb` driver claims them and `smb_attach`
(`smb.c:139-141`) mints real `/dev/smbN[-XX]` devfs nodes. Nothing in the
chain is stubbed except the wire.

`/dev/df5642` ioctls call the **production APIs** `device_detach(smbus0)`
+ `device_probe_and_attach(smbus0)` — the same functions the module
handlers invoke on kldunload/kldload (`devclass_delete_driver`,
`subr_bus.c:888-897`, detaches but never deletes children;
`bus_generic_driver_added`, `subr_bus.c:3012-3015`, re-probes them).

## Baseline (stock kernel, `run_a.log` + `run_a2.log`)

* initial: nchildren=4 (`smb0`, `smb1040`, `smb1104`, `smb1127`) →
  `/dev/smb0 smb0-10 smb0-50 smb0-67`;
* each cycle: `device_detach=0`, `device_probe_and_attach=0`,
  `after-cycle: nchildren` grows by exactly 4 (1 generic + 3 probe
  children) — 10 cycles: **4 → 44**, node count **4 → 44**;
* the re-minted probe children take remapped units
  (`devclass_alloc_unit`, `subr_bus.c:1072-1081`): e.g. the second copy
  of the address-0x10 probe child lands at unit 1041 → `/dev/smb0-11`,
  and `smbioctl` then FORCES slave 0x11 on it (`smb.c:229-231`) — an
  address no device answers. The node-name ↔ physical-address contract
  (`smb.c:134-141`, `cyapa.c:466-472`) is corrupted while duplicate
  plain nodes (`smb1`, `smb2`, ...) pile up on one physical bus.

Root cause is exactly `smbus.c:94-97` (no first-attach guard) +
`smbus.c:105-115` (detach never deletes children) + the family's
teardown asymmetry (`viapm_586b_detach`, `viapm.c:423-430`, deletes
`iicbb` but not the `smbus` child created at `viapm.c:362`).

## Fix validation (`fix.diff`, `run_a_fixed.log`)

`fix.diff` populates the bus only when `device_get_children` reports it
empty. Patched kernel (rebuilt with `nativekernel`, boot #1 Fri Oct 9
04:55, smb.ko loaded first): 9 cycles → `after-cycle: nchildren=5`
every time (the 5th is the load-order identify child), `/dev/smb*`
count constant at 5. Baseline growth eliminated.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.