# DF-5646 — unvalidated `hint.<dev>.N.irq` reaches `machintr_legacy_intr_cpuid()` → boot-time kernel panic (KKASSERT / OOB index on release kernels)

## Where
`sys/bus/isa/isahint.c:73-76` (`isahint_add_device`)

## Build
Nothing to compile — pure loader-configuration trigger.

## Run (the exact repro)
```sh
# on the guest, as root:
printf 'hint.lm.0.irq="0x10000"\n' > /boot/loader.conf.local
shutdown -r now
```

## Expected (observed 2026-10-09, guest `dfbsd` 6.5-DEVELOPMENT #0 X86_64_GENERIC, INVARIANTS)
Kernel panics during ISA bus configuration, before userland:

```
panic: assertion "irq >= 0 && irq < ioapic_abi_legacy_irq_max" failed in ioapic_abi_legacy_intr_cpuid at /usr/src/sys/platform/pc64/apic/ioapic_abi.c:1127
cpuid = 0
Trace beginning at frame 0xffffffff817adb00
ioapic_abi_legacy_intr_cpuid() at ioapic_abi_legacy_intr_cpuid+0xed
isahint_add_device() at isahint_add_device+0x193
isahint_identify() at isahint_identify+0x125
bus_generic_probe_hack() at bus_generic_probe_hack+0x75
isa_probe_children() at isa_probe_children+0x1c
Debugger("panic")
db>
```

The machine is dead at the `db>` prompt — permanent boot-time DoS from one
loader.conf line. `vm.sh reset with-src` to recover.

## Threat model
`hint.*` values come from `/boot/loader.conf*` (root/loader-stage write).
This is a robustness/validation bug in the hint→resource plumbing: any typo'd
or hostile large irq hint bricks the machine at boot. On kernels built without
`INVARIANTS` the KKASSERT is compiled out and the same input becomes an
out-of-bounds read `ioapic_irqmaps[cpuid][irq]` (ioapic_abi.c:1129-1131) with
an attacker-chosen 31-bit index (silent for small values, page-fault panic for
large ones).