DF-5606 — sys/bus/u4b/net/ruephy.c is an unbuildable FreeBSD-API orphan

Severity: Info (dead code / maintenance hazard carrying latent family defects) File: sys/bus/u4b/net/ruephy.c (232 LOC) + its header sys/bus/u4b/net/ruephyreg.h

What this is

A FreeBSD-HEAD snapshot of the RTL8150 internal-PHY miibus driver, dropped into sys/bus/u4b/net/ (rue(4) glue that was never ported — there is no if_rue.c anywhere in this tree). It is doubly dead:

1. No build target references it. Not in sys/conf/files, not in sys/bus/u4b/net/Makefile SUBDIR (aue axe axge cdce cue ipheth kue mos udav uether urndis), not in any module Makefile. The ruephy that IS compiled is a different, DragonFly-native copy: sys/dev/netif/mii_layer/ruephy.c (sys/conf/files:1094) — itself dormant (DF-5090: no "rue" NIC exists).
2. It cannot compile against this tree. Its include layout (<dev/mii/mii.h> :47, <dev/usb/net/ruephyreg.h> :51) does not exist here, and even with the includes granted (mapped onto DragonFly's real production mii headers), the source references a different mii API generation: mii_phy_detach :62, MII_PHY_END :87, struct mii_phy_funcs :90, mii_phy_dev_probe :102, mii_phy_dev_attach+MIIF_NOMANPAUSE :110, mii_phy_setmedia :132, PHY_RESET/PHY_STATUS :163/:170, 1-arg mii_phy_auto :164 — none exist or differ in sys/dev/netif/mii_layer.

Why it matters

• Audit/review noise: it looks like reachable attack surface (it is not).
• Latent carriers: if it ever were revived together with the FreeBSD new-mii core, it would reintroduce the family defects — the DF-5001 empty-media attach-panic branch and the unguarded ifm_cur derefs at ruephy.c:145 (MII_TICK) and ruephy.c:231 (status decode when autoneg is off).
• Its presence invites a bad copy-paste source for future u4b PHY glue.

Evidence in this pack

• proof.sh / proof.log — host-side static proof (build-target absence, include-layout absence, API-symbol absence, API-delta table with cites).
• build.sh / setup.sh — guest production-code KLD rig (3 stages):
• S0 control: the production twin mii_layer/ruephy.c builds cleanly through the same rig → rig is sound (build_s0.log).
• S1 verbatim: the orphan dies at ruephy.c:47:10: fatal error: dev/mii/mii.h (build_s1.log).
• S2 includes granted: with <dev/mii/*>/<dev/usb/net/ruephyreg.h> mapped onto DragonFly's unmodified production headers, the compile still fails on 8 distinct API symbols — gcc even suggests the DragonFly replacements ("did you mean 'mii_phy_set_media'?", …) (build_s2.log).
• rig_run.log — the full rig console output (all checks green, exit 0).

Reproduce

In the guest (/root/df5606, populated by this pack):

sh setup.sh   # verbatim copies from the guest's own /usr/src
sh build.sh   # S0 must build; S1/S2 must fail exactly as summarized

Host side, from the repo root:

sh findings/poc/DF-5606/proof.sh

Fix

Delete sys/bus/u4b/net/ruephy.c and sys/bus/u4b/net/ruephyreg.h (fix.diff). Also called for by DF-5090's recommended fix for the twin.

VERDICT — DF-5606: sys/bus/u4b/net/ruephy.c is an unbuildable FreeBSD-API orphan

Bottom line: Not a memory-safety defect in itself. The file is a FreeBSD-HEAD snapshot of the RTL8150 miibus PHY glue whose consumer (rue(4), if_rue.c) was never ported to DragonFly; it is referenced by no build target in the tree and cannot compile against DragonFly's mii API even when deliberately wired up and granted its FreeBSD include layout. Every latent defect it carries is therefore unreachable on any kernel buildable from this tree. Removal is the fix; DF-5090 (filed on the compiled twin sys/dev/netif/mii_layer/ruephy.c) already recommends deleting this pair.

Pass-2 analysis (family checklist)

(a) miibus methods — register reads, status decode, media tables

The only "device-supplied bits feeding indexes" surface would be ruephy_status (ruephy.c:191-232): MSR/BMCR/BMSR bits (read twice and OR'd — correct latched-bit idiom, :201/:212) are mapped to fixed IFM_* constants (:220-229); no array index, no table lookup, no length. The only table in the file, ruephys[] (:85-88), is properly terminated by MII_PHY_END. ifm_cur->ifm_media at :231 is user-validated by the ifmedia framework (SIOCSIFMEDIA), semantic-only. No OOB primitive exists here.

(b) ifmedia table construction

Not in this file — media entries are added by the mii core (mii_phy_dev_attach(..., 1) in FreeBSD's API). The empty-capability edge (BMSR_MEDIAMASK == 0 over USB → empty media list) is the DF-4930/DF-5001 family panic, owned by the hub finding.

(c) attach/detach vs miibus probing

No file-local softc state beyond struct mii_softc; attach is one core call (:110-111), detach is core-provided (:62). The DF-5394-style probe/attach race surface lives in the NIC-side plumbing (usb_ethernet.c:232 mii_phy_probe during ue_attach, :288-290 detach) — owned by the DF-5493..5495 family. No file-local race. The probe gate (:100-103: grandparent must be named "rue") additionally can never pass — no such driver exists (DF-5090 proof, sections A-C).

(d) rue(4)-supplied data

PHY_READ results flow only into bit tests and the IFM decode above. The double-read at :153-154 handles latched-low link bits. Nothing feeds a length, index, or pointer.

Latent defects the orphan would carry if ever revived with the FreeBSD new-mii core

• ruephy.c:145 — IFM_SUBTYPE(ife->ifm_media) in MII_TICK with ifm_cur taken at :118 unguarded (NULL only via the empty-media path that panics first in the family scenario).
• ruephy.c:231 — same pattern in the non-autoneg status branch.
• DF-5001 empty-media attach-panic branch via mii_phy_dev_attach(..., 1).

Verification (Phase V) — production-code KLD rig on the guest

Guest: DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC, built Jul 2 2026), gcc 8.3 [DragonFly]. Guest /usr/src/sys/bus/u4b/net/ruephy.c md5-identical to the audited repo file (83e5d308f4967b9d48494c1732aef59f), re-verified by cksum inside the rig run.

• S0 control (build_s0.log): the production twin sys/dev/netif/mii_layer/ruephy.c, copied verbatim, builds cleanly through the same KLD rig → the rig itself is sound.
• S1 verbatim orphan (build_s1.log): dies at ruephy.c:47:10: fatal error: dev/mii/mii.h: No such file or directory (FreeBSD include layout; sys/dev/mii and sys/dev/usb do not exist in DragonFly).
• S2 includes granted (build_s2.log): with <dev/mii/mii.h>, <dev/mii/miivar.h>, <dev/usb/net/ruephyreg.h> resolved to DragonFly's unmodified production headers (fakeinc, cksums in rig_run.log), the compile still fails on 8 distinct API symbols: mii_phy_detach :62, MII_PHY_END :87, struct mii_phy_funcs :90, mii_phy_dev_probe :102, mii_phy_dev_attach + MIIF_NOMANPAUSE :110, mii_phy_setmedia :132, PHY_RESET/PHY_STATUS :163/:170, 1-arg mii_phy_auto :164. GCC's own suggestions spell out the generation gap ("did you mean 'mii_phy_set_media'?", "did you mean 'mii_phy_probe'?").
• Host static proof (proof.log): zero build-target references; include layout absent; API symbols absent from sys/dev/netif/mii_layer (only in-tree vestiges: atphy.c:89 inside #if 0, atphy.c:99/:114 comments).

Nothing was kldload'ed; /usr/src untouched; guest never panicked.

Attempts

1. First rig run: stages mis-evaluated — my -I rode CFLAGS+=, which sys/conf/kmod.mk:98 rebuilds with a plain = (CFLAGS= ${COPTFLAGS} ${KCFLAGS} ${COPTS} ...), so the granted includes never reached cc, and the S1 grep pattern assumed gcc quote style while the actual message is clang/gcc-8 caret style. Control S0 already built OK.
2. Second rig run: COPTS+= -I... (kmod.mk:108-109 preserves -I* past -nostdinc), grep patterns fixed → all three stages exactly as predicted, rig exit 0.

Fix

fix.diff deletes sys/bus/u4b/net/ruephy.c and sys/bus/u4b/net/ruephyreg.h (git-apply-able, verified with git apply --check). No runtime behavior changes: nothing references them. Fix validation is not applicable — there is no baseline runtime behavior of dead code to compare against.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.