DF-5003 — truephy_attach "no media present" branch skips all media setup →

miibus_mediainit panics on the empty list (4th instance of the DF-4930 family)

What

truephy_attach() has the standard family shape (truephy.c:170-176):

    if ((sc->mii_capabilities & BMSR_MEDIAMASK) == 0 &&
        (sc->mii_extcapabilities & EXTSR_MEDIAMASK) == 0)
        kprintf("no media present");          /* <-- adds NO media */
    else
        mii_phy_add_media(sc);
    ...
    MIIBUS_MEDIAINIT(sc->mii_dev);            /* truephy.c:178 */

When the ET1011/ET1011C's BMSR reports no media bits and EXTSR reports no extended media (faulty or malicious PHY-in-the-loop), no media entry is ever added; MIIBUS_MEDIAINIT dispatches to miibus_mediainit() (mii.c:227-245), whose terminal ifmedia_set(&mii->mii_media, 0) panics — panic("ifmedia_set") (sys/net/if_media.c:174). Same sink as DF-4930 (atphy), DF-4957 (ciphy), DF-4981 (jmphy) — proven live on this kernel by the DF-5001 hub replay (../DF-5001/panic.txt: the walk from mii.c:238-244 on an empty list → panic: ifmedia_set, guest down).

truephy-specific pass-2 note: the family leaf-fix pattern from DF-4930 ("just call mii_phy_add_media() unconditionally") does NOT work here — truephy always sets MIIF_NOISOLATE (truephy.c:157) and mii_phy_add_media()'s IFM_NONE fallback is gated on MIIF_NOISOLATE being CLEAR (mii_physubr.c:230-232), so an unconditional call still adds nothing. The working fixes are (a) the hub fix (DF-5001, recommended — covers the whole family) or (b) an explicit ifmedia_add in the no-media branch (fix.diff here, mirroring DF-4957's ciphy fix).

Reproduce

The sink is already proven on the guest kernel by the DF-5001 pack (../DF-5001/: baseline hw.miihub_fire=1 → panic + guest down; hw.miihub_fixcheck=1 → fixed walk survives). What cannot be exercised on this guest is the entry into the branch: it requires an Agere ET1011/ET1011C PHY (MII_PHYDESC(AGERE, ET1011/ET1011C), truephy.c:69-73) whose ID registers match but whose BMSR/EXTSR media bits read zero — PHY register behavior is not emulatable in QEMU. Hence not_reproduced end-to-end (same classification as DF-4930/4957/4981).

Fix

Primary: the DF-5001 hub fix (miibus_mediainit empty-list guard) — one change covers every family member including this one. Leaf parity: fix.diff (explicit IFM_NONE fallback via ifmedia_add; applies cleanly; compiles under -Werror as a KLD source on the guest — fixcheck-build.log).

DF-5003 VERDICT — NOT REPRODUCED end-to-end (hardware precondition);

code path certain; sink proven live by the DF-5001 hub replay

Bottom line: truephy_attach()'s "no media present" branch (truephy.c:171-175) adds no media entry, yet attach still terminates in MIIBUS_MEDIAINIT(sc->mii_dev) (truephy.c:178) → miibus_mediainit() (mii.c:227-245) → ifmedia_set(&mii->mii_media, 0) (mii.c:244) → panic("ifmedia_set") (sys/net/if_media.c:174). This is the fourth instance of the DF-4930/DF-4957/DF-4981 family, and the sink itself has now been executed live on this exact kernel by the DF-5001 hub replay (../DF-5001/panic.txt: ifmedia_set: no match for 0x0/0xfffffff → panic: ifmedia_set, trace ifmedia_set<-miihub_fire<-sysctl, guest down; the fixed walk survives in ../DF-5001/run.2.log).

Why not_reproduced (consistent with the family)

Entering the branch requires an Agere ET1011/ET1011C PHY whose ID registers match the truephy table (truephy.c:69-73) while BMSR reports BMSR_MEDIAMASK == 0 and EXTSR EXTSR_MEDIAMASK == 0 — a faulty or malicious PHY-in-the-loop. The QEMU guest has no such PHY and MDIO register behavior is not emulatable, so the end-to-end chain cannot run here (identical classification to DF-4930/DF-4957/DF-4981: Low, hardware-fault precondition, attach-time DoS, no unprivileged trigger).

Pass-2 deltas vs. the sibling findings

1. The DF-4930 leaf-fix pattern is a no-op for this driver. truephy.c:157 sets MIIF_NOISOLATE before the media branch, and mii_phy_add_media()'s IFM_NONE fallback is gated on MIIF_NOISOLATE being clear (mii_physubr.c:230-232) — an unconditional mii_phy_add_media() would still add zero entries and the panic would remain. The correct fixes are the hub guard (DF-5001, primary) or an explicit ifmedia_add (this pack's fix.diff, mirroring DF-4957's ciphy fix which had the same constraint).
2. Multiphy ordering note: with several PHYs on the bus, the FIRST attaching PHY drives miibus_mediainit (each PHY attach ends in MIIBUS_MEDIAINIT); a zero-cap truephy first in the list panics before later PHYs can add media — the hub guard also fixes that ordering window.

Fix

fix.diff — explicit ifmedia_add(&mii->mii_media, IFM_MAKEWORD(IFM_ETHER, IFM_NONE, 0, sc->mii_inst), MII_MEDIA_NONE, NULL) inside the no-media branch. Applies cleanly (git apply --check OK); the patched truephy.c compiles clean under the kernel's full -Werror set as a KLD source on the guest (fixcheck-build.log). The DF-5001 hub fix is the recommended family fix and covers this driver without any truephy change.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.