DF-5009 — rlphy_service() entry KASSERT panics stock GENERIC kernels on multi-PHY MII buses

What

rlphy_service() opens with

KASSERT(IFM_INST(ife->ifm_media) == sc->mii_inst,
    ("rlphy_service: can't isolate RealTek PHY"));   /* rlphy.c:200-201 */

before the switch (cmd), i.e. for MII_MEDIACHG, MII_TICK and MII_POLLSTAT alike. The miibus dispatch routines call every PHY's service routine with the one shared mii->mii_media.ifm_cur (mii.c:309-318, 330-333, 346-348). rlphy enforces instance 0 for itself at attach (rlphy.c:145-148) but nothing stops a different PHY driver from attaching afterwards as instance 1 (miibus_probe creates a child for every address with media bits in BMSR, mii.c:138-162). When the currently selected media belongs to that sibling instance, the KASSERT fires — on any INVARIANTS kernel, which the default X86_64_GENERIC config is (sys/config/X86_64_GENERIC:56).

Sibling selection is reachable in two ways: * the operator selects a media word unique to the sibling (combo boards: fiber PHY with 1000SX, T4-capable PHY, …). Note ifmedia_match() treats the instance field as don't-care (ifm_mask seeded with IFM_IMASK at miibus_attach, mii.c:180; if_media.c:393-413), so an instance-1 word is only selectable when no first-PHY entry shares its subtype — exactly the unique-subtype case. * the default ifmedia_set() in miibus_mediainit() (mii.c:238-244) stays with instance 0, so plain autoselect does NOT trigger; the sibling must be selected explicitly.

After the selection the panic recurs automatically once per second (MII_TICK from the MAC watchdog) and on every unprivileged SIOCGIFMEDIA (ifconfig read → mii_pollstat → MII_POLLSTAT).

Reproduced

Stock X86_64_GENERIC guest (DragonFly 6.5-DEVELOPMENT, built 2026-07-02). A synthetic out-of-tree KLD ("fakemic") manufactures the dual-PHY hardware precondition: canned MII register image with a RealTek RTL8201L at address 0 (→ rlphy, instance 0) and an unknown-vendor PHY at address 1 (→ ukphy, instance 1) that additionally advertises 100baseT4 (a subtype rlphy never adds). sysctl -w kern.fakemic_arm=1 emulates ifconfig fakemic0 media 100baseT4 (the sibling's unique word) and then invokes the watchdog mii_tick():

panic: rlphy_service: can't isolate RealTek PHY
rlphy_service() at rlphy_service+0x29e
mii_tick() at mii_tick+0x3a
fakemic_arm_sysctl() at ...
sysctl_root ...

Full serial-console capture in panic.txt; procedure in run.log / run.sh. The KLD substitutes ~30 lines of register-canning for the (rare, unemulatable) physical dual-PHY board; everything from mii_phy_probe() down is the real in-kernel mii/rlphy/ukphy stack.

Fix validated

fix.diff replaces the KASSERT with the standard foreign-instance guard (the same shape as ukphy.c:200-202 and xmphy.c:171-184/225-227): if (IFM_INST(ife->ifm_media) != sc->mii_inst) return (0); Built as a kernel (make nativekernel), installed, rebooted, identical trigger re-run: no panic, mii_tick survived, guest healthy (run.fixed.log).

Severity

Low — kernel DoS (panic), requires an rlphy-compatible PHY co-resident with a second PHY on one MII bus (RTL8201L / ICPLUS IP101 combo boards, 8129 cards with dual PHYs) plus an operator selecting the sibling's unique media. Same family and mechanism class as DF-1973 (mlphy). CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (4.5).

Contents

• fakemic.c, Makefile — synthetic dual-PHY MII MAC KLD (the PoC)
• build.sh / run.sh — exact commands
• build.log — module build output
• run.log — baseline (stock kernel) transcript → panic
• run.fixed.log — patched kernel transcript → survives
• panic.txt — serial console capture of the panic + backtrace
• env.txt — guest/kernel/compiler info
• fix.diff — the verified one-hunk fix

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.