# DF-5654 — VERDICT

**Finding:** `elcr_resume()` (elcr.c:120-126) is dead code — zero
callers in sys/ — and no other path re-reads or rewrites the ELCR after
boot. The kernel's ELCR world model is: read hardware once in
`elcr_probe()` (elcr.c:75), keep a shadow, write deltas. Nothing ever
repairs the hardware from the shadow.

**Verdict: REPRODUCED (live): the divergence is invisible to the
kernel, and the dead function is exactly the missing repair. Severity
Info (unreachable on this platform today — suspend itself is stubbed —
but a real latent defect for the resume path).**

## Live proof (run.log phase D)

1. **No resync path:** the harness flips irq5's bit in the *hardware*
   with one raw `outb(0x4d0, b^0x20)` (SMM/firmware/VM-migration
   surrogate). `elcr_read_trigger(5)` still returns `E` from the stale
   shadow while the port reads `0x20` — the kernel literally cannot
   observe the divergence; there is no re-read of the register anywhere
   (grep: `elcr_status` is assigned only at elcr.c:75 probe and
   elcr.c:113 write).

2. **The dead function is the exact fix:** calling `elcr_resume()`
   directly from the KLD rewrote both bytes from the shadow and the
   hardware returned to the 0x0c00 baseline byte-exactly
   (`D2 ... repaired=YES`). One `lwkt`-safe call at the right resume
   hook is all that is missing.

## Why this matters (and why only Info here)

* **Resume:** on ACPI S3 the PICs are reprogrammed by the wakeup path;
  the ELCR (in the southbridge) loses nothing on *this* QEMU rig and —
  more decisively — DragonFly/pc64 suspend is currently stubbed
  (`acpi_sleep_machdep` no-op, acpi_wakeup.c:50-54, confirmed in the
  DF-5616 pass), and `icu_reinit()` (icu.c:127, "ICU reinitialize when
  ICU configuration has lost") — the natural caller — is itself dead
  code. So the missing wiring is doubly unreachable today. The moment
  either gains a caller, ELCR trigger modes silently stay whatever the
  firmware reset them to (all-edge), breaking every level-triggered
  ISA IRQ (SCI included — acpi_fadt.c:195 configures it level through
  this very API).
* **Early-out blind spot (same class):** `elcr_write_trigger()` skips
  the port write when the shadow bit already matches (elcr.c:111-112),
  so a "set level" request for an irq whose *shadow* says level is a
  no-op even if the *hardware* bit was lost — the shadow-authoritative
  model has no fallback.
* **Not attacker-reachable:** no unprivileged path; the divergence
  sources (SMM, migration, firmware) are environmental. Info.

## Fix

Wire `elcr_resume()` into the ICU re-init path (`icu_reinit()`,
icu.c:127 — its documented purpose is "ICU reinitialize when ICU
configuration has lost"; the ELCR must be restored alongside the ICW
reprogram `icu_init()` performs). fix.diff adds the call (plus the
`elcr_var.h` include). When suspend/resume lands, the wakeup path
should call `icu_reinit()` (or `elcr_resume()` directly) — the live
D2 result proves the one-liner is sufficient.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.