# DF-1976 Verification

## Verdict
**SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).**

The cited defect exists in the audited source at `sys/dev/drm/linux_workqueue.c:308-319`.
Reproduction on the running guest is **not possible** because the affected
code is part of the drm compatibility layer (compiled as a kernel module,
not in GENERIC, and exercised primarily by GPU drivers needing real hardware).

## Mechanism (source-only confirmation)
flush_workqueue (linux_workqueue.c:308-319) uses a stack-local work_struct
whose __flush_work_func (301-305) calls wakeup_one(work) from INSIDE func
while work->running is still true (process_all_work sets running=false at
line 96, AFTER func returns at line 89). The flush loop re-checks running
(still true) and re-enters tsleep(&__flush_work, 0, "flshwq", 0) — timo=0
means infinite (kern_synch.c skips timeout setup). No further wakeup is
ever sent, so the caller hangs forever in D-state.

## Recommended fix
Change tsleep timeout from 0 (infinite) to 1 (1-tick poll) so the
missed-wakeup race self-corrects within one tick instead of hanging forever.

The full `git apply`-able diff lives in `fix.diff` in this folder.