# DF-5648 — shared `isab_devclass` unit-0 theft: ACPI Processor Container preempts `isab0`/`isa0`, silently renumbering the real PCI-ISA bridge to `isab1`/`isa1` (phantom empty ISA bus; hint-misdirection/double-enumeration hazard on static-hint kernels)

Finding file: `sys/bus/pci/isa_pci.c` (pass 2). Severity **Info**, confidence **certain** —
the mechanism is live-observed on the audit guest across two independent boots.

## How to reproduce (live introspection — no exploit code; the finding is a boot-time
bus-topology/numbering defect, deterministic on any QEMU i440fx rig with default ACPI)

1. `dfbsd-qemu/vm.sh up` (guest boots to ssh)
2. `dfbsd-qemu/vm.sh run_root './run_root_introspect.sh'`  (or run the commands in
   `trigger.sh` directly)

## Expected output (what constitutes reproduction)

`dmesg` shows, in this order:

```
isab0: <ACPI Generic ISA bridge> on acpi0        <- ACPI container stole unit 0 (isab0)
isa0: <ISA bus> on isab0                         <- phantom ISA bus (zero children)
isab1: <PCI-ISA bridge> at device 1.0 on pci0    <- THIS FILE's driver, renumbered 0->1
isa1: <ISA bus> on isab1                         <- the REAL ISA bus (vga0, orm0 here)
```

`devinfo` shows the real devices (`vga0`, `orm0`) under `isa1` under `isab1@pci0:0:1:0`
(Intel PIIX3 `0x70008086`, matched by `isab_probe` via class `0x0601`,
sys/bus/pci/isa_pci.c:100-102; the devid is also in the compat table at
sys/bus/pci/isa_pci.c:113), while `isab0`→`isa0` under `acpi0` (device `\_SB_.CPUS`,
`_HID=ACPI0010` Processor Container, `_CID=PNP0A06` matched by `acpi_isab_probe`,
sys/dev/acpica/acpi_isab.c:93-105) has **no children at all**.

`run.2.log` documents the negative-control experiment: a kenv hint
(`hint.foo.0.at="isa"` in /boot/loader.conf + reboot) creates **no** device on either
bus on this kernel, because `isahint_identify` enumerates via `resource_query_string`
which only walks the compiled-in static devtab (sys/kern/subr_bus.c:2402-2412) —
kenv hints are only honored for point lookups (`resource_kenv`, subr_bus.c:2300-2325).
The guest was `vm.sh reset with-src`'d afterwards (config restored).

## Impact ceiling

- Default/GENERIC rig (no compiled-in ISA hints): **functionally harmless** —
  proven live; the real bus is fully operational at isa1.
- Kernel with static ISA hints compiled in + container firmware: `at isa0`-targeted
  hints misdirect to the resourceless phantom bus, and generic `at isa` hints
  double-enumerate on BOTH buses (`isahint.c:121-129` has no first-bus guard,
  unlike the rescan guard in orm/vga identify) → duplicate device instances for the
  same physical hardware; shareable legacy IRQs can be registered by both.
- No unprivileged-attacker path: every input (ACPI namespace, PCI config space,
  loader hints) is firmware/boot-config controlled (root-equivalent).

## Artifacts

- `run.log`     — decisive dmesg/devinfo/pciconf snapshot (both boots' dmesg visible)
- `run.2.log`   — kenv-hint negative-control experiment transcript
- `trigger.sh`  — exact introspection commands
- `env.txt`     — guest uname/kernel
- `fix.diff`    — proposed guard (isahint generic-hint first-bus guard)
- `verdict.json`/`manifest.json`