# DF-0181 — sysctl_hostname XLOCK leak (jail->host DoS)

## Summary
`sysctl_hostname` (kern_mib.c:209) leaks `SYSCTL_XLOCK` (LK_EXCLUSIVE
on every CPU) when a jailed process without
`PRISON_CAP_SYS_SET_HOSTNAME` attempts `sysctl -w kern.hostname=...`.
The EPERM return at kern_mib.c:226 skips the matching `SYSCTL_XUNLOCK()`
at :235, permanently deadlocking the host sysctl subsystem.

## Build / Run
```sh
./build.sh        # builds df0181_trigger and df0181_probe
./df0181_trigger  # must be run as host root
```

## Expected (bug present)
- Output: `helper still running -- XLOCK LEAKED (bug confirmed)`.
- Guest becomes unresponsive (host sysctl deadlocked).

## Expected (fixed kernel)
- Output: `helper exited rc=1 -> lock NOT leaked`.
- Host sysctl continues to work.

## Threat model
Exploitant: jail root (a tenant in a hosted multi-tenant environment).
Unprivileged users cannot create jails, but jail-root is standard.
CVSS: PR:H.

## Files
- `df0181_trigger.c` — single-process driver (jail + clear-cap + trigger + probe).
- `df0181_probe.c` — standalone 5 s-alarm sysctl probe.
- `fix.diff` — adds `SYSCTL_XUNLOCK()+SYSCTL_SLOCK()` on the EPERM return.
- `VERDICT.md` — full narrative.