# DF-0019 — PoC

`usched_bsd4.queue_checks=0` → kernel panic (root-only self-DoS).

## The bug

`kern.usched_bsd4.queue_checks` (`sys/kern/usched_bsd4.c:2043`) is
`SYSCTL_ADD_INT(..., CTLFLAG_RW, ...)` with the default handler — no lower
bound. Setting it to `<=0` makes `bsd4_chooseproc_locked_cache_coherent`'s
`while (checks < usched_bsd4_queue_checks)` loop (`:1483`) never run, so
`min_level_lwp` stays `NULL`; then `:1544` `lp = min_level_lwp` (NULL) →
`KASSERT(lp)` (`:1548`, INVARIANTS) or NULL-deref (`:1560`/`:1572`,
production). Kernel panic on the next user reschedule.

## Important: default scheduler is `dfly`, not `bsd4`

The DragonFlyBSD default user scheduler is `dfly`
(`sys/kern/kern_usched.c:72`). The `bsd4` code path is dormant unless a
process explicitly switches via `usched_set(USCHED_SET_SCHEDULER, "bsd4")`.
The trigger PoC (`df0019.c`) does this; the original `queue_checks_panic.sh`
did not and could not fire the panic.

## Build (as root on the guest)

```
sh build.sh
# or: cc -O2 -o df0019 df0019.c
```

## Run (as root on the guest, disposable VM)

```
sh run.sh
# or: ./df0019 24
```

## Expected output

**Bug present (unpatched #0 kernel):**
```
panic: chooseproc: at least the first lp was good
bsd4_release_curproc() at bsd4_release_curproc+0x89a
bsd4_acquire_curproc() at bsd4_acquire_curproc+0x17d
syscall2() at syscall2+0x213
```

**Bug fixed (patched #1 kernel):**
```
sysctl: kern.usched_bsd4.queue_checks=0: Invalid argument
survived — no panic. exit 0.
```

## Files

- `df0019.c` — working trigger (switches to bsd4 scheduler, sets queue_checks=0).
- `load.c` — auxiliary heavy-workload launcher (stress-test artifact).
- `queue_checks_panic.sh` — original sysctl-only trigger (does NOT switch
  scheduler; kept for reference).
- `build.sh` / `run.sh` — repro scripts.
- `fix.diff` — the validated fix (git-apply-able).
- `VERDICT.md` — full analysis.
- `run.log` / `fix_run.log` — baseline panic / patched clean-exit logs.
- `panic.txt` — panic signature from serial console.
- `fix_build.log` — full kernel build output.
- `env.txt` — guest environment.