run.log - DF-2693 decisive run (STOCK kernel #0, unprivileged user t1)

Guest:   DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC, INVARIANTS), stock
Kernel:  uname -v: ... #0: Thu Jul  2 06:02:54 UTC 2026
Command: su -l t1 -c /tmp/t1home/postsig_race
         (8 threads: 4 x kill(getpid(), SIGUSR1) loop,
          4 x sigaction(SIGUSR1, SIG_IGN <-> handler) loop)
Build:   cc -O2 -Wall -pthread -o postsig_race postsig_race.c

stdout:  "racing 150 seconds..." (output lost when the guest died)

serial console (panic.txt):
  panic: postsig action            <- kern_sig.c:2309 KASSERT text
  (interleaved on the console with two
   "should not hit signal 30!" warnings from issignal(), kern_sig.c:2218,
   the same race seen from the other side)
  cpuid = 4
  Trace beginning at frame 0xfffff80117e93828
  postsig() at postsig+0x3ae 0xffffffff80661f8e
  userret() at userret+0x28b 0xffffffff80bd59ab
  syscall2() at syscall2+0x186 0xffffffff80bd6a76
  Debugger("panic")

Symbol confirmation (gdb on /usr/obj/usr/src/sys/X86_64_GENERIC/kernel.debug):
  Line 2309 of "/usr/src/sys/kern/kern_sig.c" starts at address
  0xffffffff80661f80 <postsig+928> and ends at 0xffffffff80661f90 <postsig+944>
  2309: KASSERT(action != SIG_IGN && !SIGISMEMBER(lp->lwp_sigmask, sig),
  2310:     ("postsig action"));

postsig+0x3ae == postsig+942 falls inside postsig+928..944 => the faulting
instruction is exactly the KASSERT at kern_sig.c:2309.

An earlier run on the kernel carrying only the (unrelated) DF-2691 fix
panicked identically (postsig+0x3ae, cpuid 5) within 150 s.

Result: reproduced on stock INVARIANTS kernel, unprivileged, impact=panic
(local DoS).  On non-INVARIANTS kernels the KASSERT is compiled out and the
race degrades to sv_sendsig installing SIG_IGN (== (void *)1) as the
handler - the affected process jumps to address 1 and dies by SIGSEGV
(self-inflicted; POSIX leaves the outcome unspecified).