# Driver matching contract (K1411–K1415)

`DeviceIdentity` contains a transport, vendor ID, device ID, and normalized
`DeviceClass`. For the current VirtIO MMIO development path, the class is a
software classification of the observed DeviceID; MMIO has no PCI class
register. The allowlist contains exactly two tuples:

| Transport | Vendor | DeviceID | Class | Driver |
| --- | --- | --- | --- | --- |
| MMIO | QEMU `0x554d4551` | `2` | Block | VirtioBlock |
| MMIO | QEMU `0x554d4551` | `1` | Network | VirtioNetwork |

`match_driver` returns a driver and device kind only for an exact tuple.
Unsupported transport, vendor, class, and device tuples have separate errors.
The `MatchedRegistry` checks this tuple and the physical key's transport
before any resource claim or device handle is published. On success it owns
the generation-bearing handle, driver binding, and exclusive resource claims.
On failure all three tables remain unchanged. Detach releases the binding and
logical claims together; stale handles cannot release another generation.

The positive case binds one block and one network identity to their exact
drivers. The negative case rejects an unsupported class and a mismatched
known class, compares complete snapshots before and after, and verifies the
healthy binding still works. K1415 may read live MMIO vendor and DeviceID
registers, then inject an unsupported normalized class into the guest model;
that proves the rejection path in the guest, not presence of a physical
unsupported device. PCI matching and hardware driver activation are outside
this bounded allowlist. The development source is `os-device-registry/src/lib.rs`;
the canonical product kernel source remains frozen.