# DF-1976 PoC — flush_workqueue infinite tsleep hang

## Kernel module variant (most reliable)

```c
/* flush_hang.c -- Build: cc -DKERNEL -c flush_hang.c &&
 *                ld -d -T /usr/lib/ldscripts/kld.x -o flush_hang.ko flush_hang.o
 * Run: kldload ./flush_hang.ko   (hangs forever in D-state)
 */
#include <sys/types.h>
#include <sys/module.h>
#include <sys/kernel.h>
#include <drm/drmP.h>
#include <linux/workqueue.h>
static int flush_hang_load(struct module *m, int cmd, void *arg) {
    if (cmd == MOD_LOAD) {
        kprintf("about to call flush_workqueue -- will hang forever\n");
        flush_workqueue(system_wq);
    }
    return 0;
}
DEV_MODULE(flush_hang, flush_hang_load, NULL);
```

## Userspace variant (semi-unprivileged)

Open /dev/dri/renderD128; register a userptr BO on mmap'd memory whose pages
are swapped out (madvise(MADV_DONTNEED) + pressure); submit EXECBUFFER2
referencing that BO. The EAGAIN slowpath at i915_gem_execbuffer.c:1729 calls
flush_workqueue(userptr_wq) and hangs the calling process in permanent
D-state.

## Expected output

`ps -axl | grep <pid>` shows state `D` with wmesg `flshwq`. The thread cannot
be killed with kill -9 (tsleep with flags=0 ignores signals).