DF-5637 VERDICT — REPRODUCED

Root cause: smbus_release_bus() (sys/bus/smbus/smbconf.c:151-180) performs the parent teardown SMBUS_CALLBACK(parent, SMB_RELEASE_BUS, NULL) at smbconf.c:160 before validating sc->owner == dev at smbconf.c:166, then broadcasts wakeup(sc) at smbconf.c:177 even when validation fails (EACCES). Under the iicsmb bridge the parent call is iicbus_release_bus(parent, iicsmb_dev) (iicsmb.c:263-266), and because every smbus requester funnels through the same iicsmb device token, the iicbus ownership check trivially passes: any smbus child device_t — owner or not — succeeds in releasing the underlying iicbus.

Reproduced (stock kernel, same rig/chain as DF-5636): F3: with devA the recorded owner, a non-owner devB's smbus_release_bus returned EACCES yet the iicbus had been released — the rig's direct iicbus_request_bus(iicbus0, devC, IIC_DONTWAIT) probe succeeded (=0), proving the bridge exclusion under the still-official owner was gone (summary=0x1, run_baseline.log). F3B: the same non-owner release woke a parked requester into a success return while sc->owner still equaled devA — a grant with no release at all (compounding with the DF-5636 loop bug). Wedge consequence observed live: after a non-owner release tore the bridge, the real owner's own release failed EACCES at the callback and left sc->owner set forever, parking all subsequent requesters.

Fixed kernel (fix.diff, kernel #3): release validates ownership first (EACCES without touching the bridge), and the EACCES path no longer wakes anyone: F3 probe refused with EWOULDBLOCK (bridge exclusion intact), F3B waiter stays parked until the real release (GOOD on fixed code), no wedges across the whole suite.

Not separately demonstrated: the cross-CPU double-acquire via the per-CPU-only crit_enter() sections (smbconf.c:165-174, and smbconf.c:127-136 in request) — structurally the DF-5566 MP twin; the window is a few instructions and the deterministic protocol bugs above were the priority. The fix keeps the crit sections (matching the iiconf twin's scope); a lock-based rework belongs to a family-wide cleanup.

Classification: status=reproduced, reproduced=1, impact=dos (protocol teardown / permanent bus wedge / spurious wake), confidence certain. Severity Low: requires a caller passing a wrong/non-owner device_t (driver bug, error-path misuse, or the wedge chain above) — root/HW-config gated, same band as the DF-5566 twin it mirrors.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.