# DF-1979 Verification

## Verdict
**SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).**

The cited defect exists in the audited source at `sys/dev/drm/linux_workqueue.c:119-149`.
Part of the drm compatibility layer (module, not in GENERIC).

## Mechanism (source-only confirmation)
On bound multi-CPU workqueues (num_workers==ncpus), queue_work (119-149)
selects worker = workers[mycpuid] and takes ONLY that worker's lock, but
reads/writes work->on_queue/running/worker (shared fields) without any
per-work lock. Concurrent queue_work for the same work from different CPUs
each take their own CPU worker lock, both observe on_queue==false, both
STAILQ_INSERT_TAIL → work on two lists → STAILQ corruption, double execution,
or list traversal into foreign worker's list.

## Recommended fix
Add a per-workqueue queue_lock and hold it across the entire on_queue/running
check + insert critical section in queue_work, serializing cross-CPU access
to shared work fields.

The full `git apply`-able diff lives in `fix.diff` in this folder.