DF-3724 — ixgbe_led_{on,off}_t_X550em: PHY register read return ignored → uninitialized stack word masked and written back to the PHY

File: sys/dev/netif/ix/ixgbe_x550.c:4541-4559, 4566-4584 Severity: Info (latent — LED ops have no caller in if_ix.c) Confidence: certain (DF-3643/3671 parity)

ixgbe_read_phy_reg() (MDIO over SWFW+token semaphore) can fail (IXGBE_ERR_PHY / SWFW_SYNC / MDIO timeout). Both LED functions ignore the return and then compute phy_data |= / &= ~MASK on the uninitialized stack u16 phy_data and write it into X557 LED_PROVISIONING. DF-3643/3671 family (failed read → garbage write-back).

• Dead in-tree: if_ix.c never calls led_on/led_off (verified: no caller of hw->mac.ops.led_* or ixgbe_led_* in the driver); op is exported shared-code surface for future/tools callers.
• Not runtime-verifiable: guest has no X550 NIC (see ../DF-3723/env.txt).
• fix.diff (status checks + s32 status decl) compile-validated on guest /usr/src module build with -Werror — see fix_build.log.

DF-3724 — VERDICT

Status: inconclusive (no X550 hardware on guest; no in-tree caller of the LED ops). Source-certain defect pattern (DF-3643/3671 family).

• ixgbe_x550.c:4551-4552 — ixgbe_read_phy_reg(hw, ..., &phy_data) return value discarded; phy_data is an uninitialized stack u16 (declared :4543).
• ixgbe_x550.c:4553-4555 — phy_data |= IXGBE_X557_LED_MANUAL_SET_MASK; then ixgbe_write_phy_reg(...) persists the uninitialized-derived value into the X557 LED provisioning register.
• Mirror at :4576-4580 (led_off).
• Contrast with the sibling ixgbe_get_supported_physical_layer_X550em (:3652-3654) which also ignores the read but initializes ext_ability = 0 (:3621) — the LED functions do not.

Why Info

No in-tree caller: rg 'led' if_ix.c → no LED op dispatch anywhere in the driver (the ops are wired in ixgbe_init_ops_X550:95-99 but only ever invoked through ixgbe_api.c wrappers that if_ix never calls). Reachable only by future code or ported tools; impact when reached is a PHY misconfiguration (uncontrolled 16-bit value OR/AND-ed into an LED register), not kernel memory corruption.

Verification

• Guest pciconf -lv (../DF-3723/env.txt): no X550 → HAL cannot execute.
• fix.diff compile-validated on guest /usr/src (module build, -Werror, make_rc=0, see fix_build.log), reverted afterwards (md5 restored).

Recommended fix

Check both PHY access returns and bail on failure — see fix.diff.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.