{
  "finding_id": "DF-5654",
  "status": "reproduced",
  "verdict": "Live-verified on the QEMU/i440fx guest: elcr_resume() (elcr.c:120-126) has ZERO callers in sys/ \u2014 and no other path ever re-reads or rewrites the ELCR after boot (elcr_status is latched once in elcr_probe() at elcr.c:75 and only ever delta-written). The harness induced a hardware-side divergence with one raw outb(0x4d0, b^0x20) (surrogate for SMM/VM-migration/firmware/S3-reset): elcr_read_trigger(5) kept serving the stale shadow value (E) while the port read 0x20 \u2014 the divergence is structurally invisible to the kernel (no resync path exists). Calling the dead elcr_resume() directly rewrote both ELCR bytes from the shadow and restored the hardware to the 0x0c00 baseline byte-exactly (D2 ... repaired=YES) \u2014 the missing wiring, proven. Consequence when a divergence source is real: every level-triggered ISA IRQ (including ACPI SCI, configured level through this API at acpi_fadt.c:195) silently runs edge \u2014 interrupt storms/lost interrupts. Severity Info because the defect is doubly unreachable today: pc64 suspend is stubbed (acpi_sleep_machdep no-op, acpi_wakeup.c:50-54) and the natural caller icu_reinit() (icu.c:127) is itself dead code; no unprivileged reach exists.",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "run.log D1 line: raw outb flipped hw bit5: hw0x4d0=0x20 but elcr_read_trigger(5)=E -> kernel serves STALE shadow (no resync path exists; elcr_status read once at probe) ; D2 line: after elcr_resume(): hw=0x0c00 baseline=0x0c00 repaired=YES (the dead function is exactly the missing fix) ; E9: final hw=0x0c00 ... coherent=YES ... guest HEALTHY (state left exactly as found)",
  "kernel_refs": [
    "sys/platform/pc64/icu/elcr.c:75",
    "sys/platform/pc64/icu/elcr.c:111",
    "sys/platform/pc64/icu/elcr.c:120",
    "sys/platform/pc64/icu/elcr.c:124",
    "sys/platform/pc64/icu/icu.c:127",
    "sys/platform/pc64/acpica/acpi_fadt.c:195"
  ],
  "poc_changes": "Harness authored from scratch (no seed). v1 wedge documented under DF-5652 (wedge_v1.log); the D phase ran in the clean v2 pass. Divergence was induced and repaired entirely within the harness (raw outb flip -> elcr_resume() rewrite), leaving the ELCR byte-exact at its 0x0c00 baseline.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "cd /root/elcrx && sh build.sh   (bsd.kmod.mk; cc -Werror -> elcrx.ko)",
  "run_cmd": "cd /root/elcrx && sh run.sh      (phase D)",
  "code_hash": "39f7f459b92ea7e3b0202e25426ff64e974521f94aea3482396d270771cef13b (elcrx.c)",
  "notes": "Zero-caller status independently re-confirmed by rg over sys/ this pass (elcr_resume appears only in elcr.c and elcr_var.h). Same-class bullet folded in: elcr_write_trigger()s early-out (elcr.c:111-112) skips the port write when the SHADOW already matches, so it cannot repair a diverged hardware bit either \u2014 the shadow-authoritative model has no fallback short of elcr_resume(). The natural wiring point is icu_reinit() (ICU reinitialize when ICU configuration has lost, icu.c:127) \u2014 itself dead until suspend lands, which is exactly when this fix becomes load-bearing.",
  "recommended_fix": "Wire elcr_resume() into icu_reinit() (guard on elcr_found) so ELCR trigger modes are restored whenever the ICU configuration is re-established (elcr.c:120, icu.c:127)",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Info/latent-defect finding \u2014 single-fix kernel rebuild not warranted (the affected path, suspend/resume + icu_reinit, is unreachable in the current tree). fix.diff adds the elcr_found-guarded elcr_resume() call to icu_reinit() ahead of icu_init(); its behavioral delta vs the live D2 result is precisely the repair that had to be induced by hand now runs at the re-init hook \u2014 verified by inspection against run.log; nothing to regression-test on this rig.",
  "fix_evidence": "fix.diff"
}