# DF-5644 — smbus.c mints NAMELESS wildcard children; any smbus-bus driver with probe priority > GENERIC hijacks them (in-tree: ipmi)

* File: `sys/bus/smbus/smbus.c` (pass 2) — Severity: Info — untested (Phase V
  not warranted per Low/Info rule; source-proven below)

## The defect

`smbus_attach` creates its children with `name = NULL`
(`smbus.c:94`, `smbus.c:137`), and `smbus_add_child`
(`smbus.c:143-153`) is only reached by drivers that pass an explicit
name via `BUS_ADD_CHILD` (`smb.c:108`, `cyapa.c`, `atmel_mxt.c`,
`ipmi_smbus.c:59-62`). The nameless children are therefore matched
against **every** driver registered on the smbus bus
(`first_matching_driver`, `subr_bus.c:1384-1390`: no devclass → all
drivers), and the winner is decided purely by probe priority
(`subr_bus.c:1456-1459`: higher {SPECIFIC=0 > VENDOR=-10 > DEFAULT=-20
> GENERIC=-100} wins).

The bus's own generic I/O driver deliberately probes at the LOWEST
priority (`smb.c:117`, `BUS_PROBE_GENERIC`), which is only safe if every
other driver on the bus declines unrelated children. That etiquette is
already violated in-tree: `ipmi_smbus_probe` (`ipmi_smbus.c:66-70`)
returns `BUS_PROBE_DEFAULT` **unconditionally** — no unit check, no
address check. Whenever the ipmi driver is registered before the
wildcard children attach (e.g. `device ipmi` in the kernel config on an
SSIF platform, or `kldload ipmi.ko` racing boot enumeration):

* every probe-address child AND the generic child is claimed by ipmi;
* on non-SSIF platforms `ipmi_smbus_attach` fails (`ipmi_smbus.c:78-84`
  ENXIO) leaving the children driverless (`subr_bus.c:2115-2123` resets
  state) — the generic `/dev/smbN` never appears until some later
  driver-added event re-probes them;
* on SSIF platforms the generic child is attached as a SECOND ipmi
  instance on the SMBIOS address alongside the identify-created one
  (`ipmi_smbus.c:56-62`) — two SSIF pollers on one address.

Observed corollary on the audit guest (DF-5642 pack): when `smb.ko` is
registered after `smbus0` attached, `smb_identify`'s guarded child takes
unit 0 and the line-94 wildcard child is remapped to unit 1 — two smb
devices for one bus purely from load order.

## Fix direction

Give the generic child an explicit name at creation
(`device_add_child(dev, "smb", device_get_unit(dev))`), reserve
nameless probing for the address-probe children, and document that
convention for future smbus-bus drivers; separately, `ipmi_smbus_probe`
must decline children it did not create (check `device_get_unit(dev) &
0x0400` or match its identify child) instead of blanket DEFAULT.

verdict: `verdict.json` (status: untested — Phase V skipped per Low/Info rule).