{
  "finding_id": "DF-5642",
  "status": "reproduced",
  "verdict": "REPRODUCED on the stock kernel via a production-code KLD rig hosting the real in-kernel smbus driver (registered on a fake controller exactly like intpm.c:903, smbus0 created exactly like intpm.c:331-337): smbus_attach (smbus.c:94-97) re-creates the generic child AND the whole address-probe child set on EVERY attach, while smbus_detach (smbus.c:105-115) and every teardown path (devclass_delete_driver subr_bus.c:888-897; viapm_586b_detach viapm.c:423-430 deletes iicbb but not the smbus child created at viapm.c:362) only detach children, never delete them. Each device_detach(smbus0)+device_probe_and_attach(smbus0) cycle (the production kldunload/kldload choreography) leaked the full set: nchildren 4->44 and /dev/smb node count 4->44 after 10 cycles (+4/cycle deterministic); re-minted probe children take remapped units (devclass_alloc_unit subr_bus.c:1072-1081) so duplicate forced-slave nodes appear with corrupted address encoding (second copy of address 0x10 lands at unit 1041 -> /dev/smb0-11, whose ioctl path forces slave 0x11 -- an address nothing answers). fix.diff guards population on first attach (device_get_children); on the patched kernel (nativekernel rebuild, boot #1 Oct 9) 9 cycles keep nchildren=5 and node count constant -- baseline growth eliminated.",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "exploit_chain": "root: detach+re-attach smbus0 (kldunload/kldload of a bridge whose smbus child survives -- viapm 586b, out-of-tree bridges, rescan/rebind, or devclass_delete_driver of the smbus driver with a resident parent) -> each cycle device_add_child mints 1+N struct bsd_device (M_BUS, ~0x2c0 bytes each) while the survivors re-attach -> unbounded heap leak + duplicate remapped /dev/smbN[-XX] nodes on one physical bus with corrupted slave-address binding (smb.c:229-231 forces slave=unit&1023).",
  "evidence": "run_a2.log (attach: nchildren=4 -> after-cycle: nchildren=8..44, FINAL_node_count=44; duplicate node list smb0-11..13/51..53/68..6a + smb1..6); run_a.log (per-cycle device_detach=0/reattach=0 with nchildren growth); run_a_fixed.log (patched: after9: 5 nodes, 9x after-cycle: nchildren=5); env.txt (stock vs patched uname); panic_raw.txt also holds the serial history.",
  "kernel_refs": [
    "sys/bus/smbus/smbus.c:94-97",
    "sys/bus/smbus/smbus.c:105-115",
    "sys/kern/subr_bus.c:888-897",
    "sys/kern/subr_bus.c:1072-1081",
    "sys/kern/subr_bus.c:3012-3015",
    "sys/dev/powermng/viapm/viapm.c:362",
    "sys/dev/powermng/viapm/viapm.c:423-430",
    "sys/dev/smbus/smb/smb.c:134-141",
    "sys/dev/smbus/smb/smb.c:229-231"
  ],
  "poc_changes": "Rig in this pack (df5642_rig.c): fake SMBus controller on nexus registers the real in-kernel smbus driver (DRIVER_MODULE(smbus, fakesmbb, ...) mirroring intpm.c:903) and creates smbus0 like intpm.c:331-337; /dev/df5642 ioctls STAT/CYCLE n drive the production device_detach/device_probe_and_attach APIs. Two build iterations fixed ioccom include / dev_ops prototypes / 64-bit respond mask; smb.ko is in-kernel on the stock guest kernel (the rebuilt fix-validation kernel needs kldload /boot/kernel/smb.ko first: repo config lacks device smb).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (baseline) / #1: Fri Oct  9 04:55:10 UTC 2026 (fix)",
  "runtime_sec": 1800,
  "guest_dirty": 0,
  "build_cmd": "guest: cd /root/df5642 && make -f Makefile SYSDIR=/usr/src/sys && cc -O -o df5642ctl df5642ctl.c  (fix kernel: cd /usr/src && patch -p1 < fix.diff && make -j6 nativekernel KERNCONF=X86_64_GENERIC && make installkernel KERNCONF=X86_64_GENERIC)",
  "run_cmd": "sh /root/df5642/run_a.sh  (baseline leak); ./df5642ctl cycle 6 (unboundedness); on patched kernel: kldload /boot/kernel/smb.ko + same (fix validation, run_a_fixed.log)",
  "code_hash": "df5642_rig.c sha256 834f76e5c1304d5c5fa8aec937f675a64ab26bf53ff79d567627201c88529854; run_a.sh sha256 c2b472c953cae9ff18b74c3ff13b27a0133f165ab2cc8caf00ee2c729a8773dc",
  "notes": "Sibling of DF-5633 (iicbus trio) -- same class, smbus layer, amplified by the 96-address probe loop. The per-address children exist to feed cyapa/atmel_mxt matching (0x400 unit encoding, cyapa.c:466-472); the encoding corruption makes remapped nodes target nonexistent slave addresses. intpm/amdpm/amdsmb/alpm/ichsmb/ig4 delete their smbus child on detach -- the leak needs a surviving-child teardown (viapm 586b, driver-unload flows, rescans).",
  "recommended_fix": "Populate the bus only when it has no children yet (device_get_children guard in smbus_attach); optionally also device_delete_children in smbus_detach.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "With fix.diff (first-attach guard) built into the guest kernel, 9 detach/re-attach cycles keep nchildren=5 and /dev/smb* count constant at 5 (baseline: +4 per cycle, 4->44); unload/reload clean, no trap.",
  "fix_evidence": "run_a_fixed.log (after9: 5 nodes; dmesg 9x after-cycle: nchildren=5; final ls shows exactly smb0 smb1 smb0-10 smb0-50 smb0-67)"
}