# DF-2710 — peer-freezable iocom reader: parked writer turns the
# "dmrace" INTERLOCK wait (kern_dmsg.c:827) into an indefinite cluster
# link stall

## What was verified (non-INVARIANTS kernel #1)

`kdmsg_state_msgtx()` sets `KDMSG_STATE_INTERLOCK` on the state of each
message it dequeues for transmission (kern_dmsg.c:1636-1637); the bit is
cleared only by the *same* thread's `kdmsg_state_cleanuptx()` **after**
`fp_write()` returns (:1663-1667). If the peer stops reading, the writer
parks inside `fp_write()` (unix-socket send buffer full) with INTERLOCK
set. `kdmsg_state_msgrx()` for any subsequent message resolving to that
state — e.g. the peer's DELETE for that msgid — hits the interlock and
sleeps 1 second per iteration in the `again:` loop (kern_dmsg.c:825-828)
**while holding no other progress**: the reader cannot consume anything
else, so the kernel-side receive buffer fills and *all* cluster traffic
in both directions stalls until the peer resumes reading.

PoC: `df2707_trigger wedge` (shared source) — parks the writer with
SO_SNDBUF=2048 + junk transactions, sends a **single** DELETE (no
duplicates — this is the benign control for DF-2707), then probes with
non-blocking one-way LNK_PAD bursts:

```
WEDGE_PROBE1_WRITTEN=863/1024 <== reader stalled (rcvbuf full)
WEDGE_PROBE2_WRITTEN=1024/1024 (reader recovered after drain)
UNMOUNT_OK
```

Reader demonstrably stops consuming (send-side EAGAIN after 863 frames
≈ rcvbuf capacity) and recovers the moment the peer drains. A peer can
hold the link frozen indefinitely; on a clustered hammer2 mount any
cluster-dependent VOP then blocks (recoverable system-wide DoS while
the peer withholds reads).

## Build & run

```
scp -F dfbsd-qemu/config findings/poc/DF-2710/df2707_trigger.c dfbsd:/root/poc/df2707/
dfbsd-qemu/vm.sh run_root 'cd /root/poc/df2707 && cc -O -I/usr/src/sys -o t df2707_trigger.c && ./t wedge'
```

## Fix direction

Bound the interlock wait (e.g. break out after a few iterations and
treat the message as EALREADY), or clear INTERLOCK before blocking in
`fp_write()` (queue-level interlock instead of state-level), so a
back-pressured writer cannot dead-wait the reader.