{
  "finding_id": "DF-5645",
  "status": "untested",
  "verdict": "Source-proven protocol defect, not runtime-verified (Phase V skipped per Low/Info rule). smbus_probe_device (smbus.c:122-140) issues smbus_trans at smbus.c:131 without smbus_request_bus -- the only in-tree transaction issuer that bypasses the sc->owner arbitration (smbus.h:34, smbconf.c:126-141; compare smb.c:240-243). On re-attach (the DF-5642 cycle) the 96 probe transactions can interleave with a live clients owned transaction on the same controller (memory-safe thanks to controller serializers, but protocol-level interleaving can wedge slow slaves and produces garbage probe results); each probe is a bounded-timeout real transaction so a quiet/wedged controller stalls the attaching thread ~96 x controller-timeout; SMB_TRANS_NOREPORT (smbus.c:132) hides controller faults as no device. Buffer is in-bounds (u_char buf[2], rcount=1, smbus.c:127-133): no memory-safety violation.",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "README.md (path:line chain); contrast with smb.c:240-243 arbitration",
  "kernel_refs": [
    "sys/bus/smbus/smbus.c:95-97",
    "sys/bus/smbus/smbus.c:122-140",
    "sys/bus/smbus/smbconf.c:126-141",
    "sys/dev/smbus/smb/smb.c:240-243"
  ],
  "poc_changes": "n/a (not built)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Fix: wrap the probe loop in smbus_request_bus(dev, dev, SMB_DONTWAIT)/smbus_release_bus and skip probing when the bus is owned.",
  "recommended_fix": "Arbitrate before probing: request the bus SMB_DONTWAIT around the smbus_attach probe loop and skip probes when it is owned.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "not validated (Info-level; skipped per contract)",
  "fix_evidence": "n/a"
}