# PoC DF-1495: midi_read/write redundant lockmgr(&m->qlock) after lksleep → refcount leak/deadlock

**Class:** recursive lock acquire / lock leak
**Cited site:** `sys/dev/sound/midi/midi.c:762, 776 (also 855, 1279)`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No on this guest — sound subsystem not loaded. Trigger requires sound.ko and a MIDI device returning EWOULDBLOCK on read.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/sound/midi/midi.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Line 762 `lksleep(&m->rchan, &m->qlock, ...)` UNCONDITIONALLY reacquires qlock before returning. Line 776 `lockmgr(&m->qlock, LK_EXCLUSIVE);` is a redundant double-acquire. Under LK_CANRECURSE (set at midi.c:323), the count goes 1->2 and is never decremented symmetrically. Each EWOULDBLOCK iteration leaks one qlock reference → eventually the lockmgr hits its recursion limit and the system deadlocks.

## Realistic impact ceiling

DoS (deadlock)

## Fix

Remove the redundant `lockmgr(&m->qlock, LK_EXCLUSIVE)` after lksleep returns (qlock was already reacquired).

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1495.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1495.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/sound/midi && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```