Just when I thought it was safe. In the original 3c905-TX NICs, the

external NatSemi PHY chip was programmed to respond to MII address 24.
In the 3c905B ASICs, the transceiver is internal but it's still mapped
to MII address 24. But *some* 3Com 3c905B ASIC revisions map the
transceiver control registers to *all* MII addresses (0 through 31).
The miibus code probes for PHYs at all MII addresses and because of
this unusual behavior, it will attempt to map the same PHY registers
several times over, which doesn't work.

Naturally, the 3c905B NIC that I tested happened not to exhibit this
behavior.

The fix is to tweak xl_miibus_readreg() and xl_miibus_writereg()
to only respond when attempting to read from MII address 24. This
is safe to do since the 3Com documentation indicates that the PHY
and/or internal transceiver will always be mapped to address 24,
and there are no 3Com XL NICs with more than one PHY.

sys/pci/if_xl.c

@@ -524,6 +524,16 @@ static int xl_miibus_readreg(dev, phy, reg)
 	struct xl_softc		*sc;
 	struct xl_mii_frame	frame;
 
+	/*
+	 * Pretend that PHYs are only available at MII address 24.
+	 * This is to guard against problems with certain 3Com ASIC
+	 * revisions that incorrectly map the internal transceiver
+	 * control registers at all MII addresses. This can cause
+	 * the miibus code to attach the same PHY several times over.
+	 */
+	if (phy != 24)
+		return(0);
+
 	sc = device_get_softc(dev);
 
 	bzero((char *)&frame, sizeof(frame));
@@ -542,6 +552,9 @@ static int xl_miibus_writereg(dev, phy, reg, data)
 	struct xl_softc		*sc;
 	struct xl_mii_frame	frame;
 
+	if (phy != 24)
+		return(0);
+
 	sc = device_get_softc(dev);
 
 	bzero((char *)&frame, sizeof(frame));