uhci_pci_attach never validates the device-reported I/O BAR size against the fixed 0x14-byte UHCI register file — every UREAD/UWRITE can touch port-I/O outside the allocated resource window (DF-5268/DF-5282 register-geometry class, UHCI variant)

Summary

sc_io_size = rman_get_size() (device-controlled BAR size) stored with no minimum check while the fixed register file spans 0x00..0x13 - on an undersized BAR every PORTSC1/2 access lands on port-I/O outside the rman window: strictly weaker than the xhci/ehci variants (fixed offsets, max 12-byte excursion, x86 port I/O never faults) - silent cross-device port-register corruption ceiling, hardware-attacker-only. No UHCI controller on the current guest; source-proof only. Reject-undersized-BAR + didinit-gated-detach fix.