{
  "finding_id": "DF-5644",
  "status": "untested",
  "verdict": "Source-proven design defect, not runtime-verified (Phase V skipped per Low/Info rule). smbus.c mints NAMELESS wildcard children (smbus.c:94 generic child, smbus.c:137 probe children) that device_probe_child matches against EVERY driver on the smbus bus (subr_bus.c:1384-1390) with priority-based winner selection (subr_bus.c:1456-1459); the buss generic driver probes at BUS_PROBE_GENERIC (-100, smb.c:117) so ANY driver returning DEFAULT or better claims the wildcard children. In-tree violator: ipmi_smbus_probe returns BUS_PROBE_DEFAULT unconditionally (ipmi_smbus.c:66-70) -- with ipmi registered before the children attach, ipmi hijacks the generic child and all 96 address children; on non-SSIF platforms its attach fails ENXIO (ipmi_smbus.c:78-84) leaving them driverless (/dev/smbN missing), on SSIF platforms it creates a second ipmi instance on the SMBIOS address. Corollary observed live in the DF-5642 runs: late-registered smb.ko + the wildcard child mint two smb devices (smb0 identify child + remapped smb1) for one bus.",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "README.md (path:line chain); DF-5642 pack run logs (smb1 remap corollary); kldstat -v smbus/smb + ipmi_smbus.c probe/identify",
  "kernel_refs": [
    "sys/bus/smbus/smbus.c:94",
    "sys/bus/smbus/smbus.c:137",
    "sys/dev/smbus/smb/smb.c:108",
    "sys/dev/smbus/smb/smb.c:117",
    "sys/dev/misc/ipmi/ipmi_smbus.c:59-70",
    "sys/kern/subr_bus.c:1384-1390",
    "sys/kern/subr_bus.c:1456-1459"
  ],
  "poc_changes": "n/a (not built)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Fix belongs partly in smbus.c (name the generic child smb at creation) and partly in ipmi_smbus.c (decline children it did not create).",
  "recommended_fix": "Create the generic child as device_add_child(dev, \"smb\", device_get_unit(dev)) and make ipmi_smbus_probe decline non-self-identified children.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "not validated (Info-level; skipped per contract)",
  "fix_evidence": "n/a"
}