# DF-5645 — smbus_attach's probe loop issues bus transactions without owning the bus (arbitration bypass)

* File: `sys/bus/smbus/smbus.c` (pass 2) — Severity: Info — untested
  (Phase V skipped per Low/Info rule)

## The defect

`smbus_probe_device` (`smbus.c:122-140`) calls `smbus_trans(dev, ...)`
directly (`smbus.c:131`) — never `smbus_request_bus`. Every other
in-tree issuer of transactions arbitrates first: `smbioctl`
(`smb.c:240-243`), `cyapa` (via its own request paths), `ipmi_ssif`.
The probe loop therefore bypasses the `sc->owner` exclusion
(`smbus.h:34`, `smbconf.c:126-141`) entirely:

* on **re-attach** (DF-5642's cycle) the 96 probe transactions can
  interleave with a live client's owned transaction on the same
  controller — the controller-level serializer keeps this memory-safe,
  but SMBus protocol-level interleaving can wedge slow slaves and
  produces garbage probe results mid-transfer;
* each probe is a bounded-timeout real transaction: 96 addresses ×
  controller timeout (e.g. ~35 ms) ≈ 3.4 s of attach-time stall on a
  quiet controller, in the attaching thread;
* `SMB_TRANS_NOREPORT` (`smbus.c:132`) suppresses the error reporting,
  so a wedged controller looks like "no devices" instead of a fault.

No memory-safety violation: the transaction buffer is `u_char buf[2]`
with `rcount = 1` (`smbus.c:127-133`) — in bounds; controller drivers
clamp counts. Filed as Info (protocol hygiene + attach stall).

## Fix direction

Wrap the probe loop in `smbus_request_bus(dev, dev, SMB_DONTWAIT)` /
`smbus_release_bus` (skip probing if the bus is owned — a re-attach
should not bounce the wire under a live client).

verdict: `verdict.json` (status: untested).