DF-5654 — VERDICT

Finding: elcr_resume() (elcr.c:120-126) is dead code — zero callers in sys/ — and no other path re-reads or rewrites the ELCR after boot. The kernel's ELCR world model is: read hardware once in elcr_probe() (elcr.c:75), keep a shadow, write deltas. Nothing ever repairs the hardware from the shadow.

Verdict: REPRODUCED (live): the divergence is invisible to the kernel, and the dead function is exactly the missing repair. Severity Info (unreachable on this platform today — suspend itself is stubbed — but a real latent defect for the resume path).

Live proof (run.log phase D)

1. No resync path: the harness flips irq5's bit in the hardware with one raw outb(0x4d0, b^0x20) (SMM/firmware/VM-migration surrogate). elcr_read_trigger(5) still returns E from the stale shadow while the port reads 0x20 — the kernel literally cannot observe the divergence; there is no re-read of the register anywhere (grep: elcr_status is assigned only at elcr.c:75 probe and elcr.c:113 write).

2. The dead function is the exact fix: calling elcr_resume() directly from the KLD rewrote both bytes from the shadow and the hardware returned to the 0x0c00 baseline byte-exactly (D2 ... repaired=YES). One lwkt-safe call at the right resume hook is all that is missing.

Why this matters (and why only Info here)

• Resume: on ACPI S3 the PICs are reprogrammed by the wakeup path; the ELCR (in the southbridge) loses nothing on this QEMU rig and — more decisively — DragonFly/pc64 suspend is currently stubbed (acpi_sleep_machdep no-op, acpi_wakeup.c:50-54, confirmed in the DF-5616 pass), and icu_reinit() (icu.c:127, "ICU reinitialize when ICU configuration has lost") — the natural caller — is itself dead code. So the missing wiring is doubly unreachable today. The moment either gains a caller, ELCR trigger modes silently stay whatever the firmware reset them to (all-edge), breaking every level-triggered ISA IRQ (SCI included — acpi_fadt.c:195 configures it level through this very API).
• Early-out blind spot (same class): elcr_write_trigger() skips the port write when the shadow bit already matches (elcr.c:111-112), so a "set level" request for an irq whose shadow says level is a no-op even if the hardware bit was lost — the shadow-authoritative model has no fallback.
• Not attacker-reachable: no unprivileged path; the divergence sources (SMM, migration, firmware) are environmental. Info.

Fix

Wire elcr_resume() into the ICU re-init path (icu_reinit(), icu.c:127 — its documented purpose is "ICU reinitialize when ICU configuration has lost"; the ELCR must be restored alongside the ICW reprogram icu_init() performs). fix.diff adds the call (plus the elcr_var.h include). When suspend/resume lands, the wakeup path should call icu_reinit() (or elcr_resume() directly) — the live D2 result proves the one-liner is sufficient.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.