# DF-2723 - Verification Verdict

**Status:** reproduced
**Impact:** denial_of_service
**Confidence:** certain

## Mechanism
PPS_IOC_FETCH hands the user timespec straight to tstohz_low: ticks = (int)(sec*hz + (u_long)tv_nsec / nstick). An unnormalized tv_nsec (>= 1e9) overflows the int, so the sleep length is whatever the truncation leaves. On sio(4) EVERY unrecognized tty ioctl falls through to pps_ioctl (sio.c:2165-2172).

## Verdict
REPRODUCED as root on the stock guest via /dev/ttyd0 (the sio console): sane {tv_sec=1,tv_nsec=0} returns ETIMEDOUT after 0.994 s; crafted {tv_sec=0, tv_nsec=2^62} computes (int)(2^62/1e7) = 1607101170 ticks (~186 days) and the fetch NEVER returns - the process had to be killed by timeout(1) at 40 s (exit 124), and the tsleep PCATCH/ERESTART cycle survives SIGALRM, so the sleep is effectively permanent. An attacker choosing the bit pattern chooses the tick count (including negative/0 variants). ttyd0 is 0600 root:wheel on this guest, so self-DoS of privileged callers.

## Threat / reachability
Any openable pps-capable device turns one ioctl into an attacker-length uninterruptible sleep of the calling thread.

## Privilege escalation assessment
n/a (thread hang; privileged fd on this guest)

## Fix
Validate/normalize timeout (reject tv_nsec<0 or >=1000000000) in the PPS_IOC_FETCH handler before calling pps_fetch_timeout.

## Kernel references
- `sys/kern/kern_clock.c:1618`
- `sys/kern/kern_clock.c:1265`
- `sys/kern/kern_clock.c:1643`
- `sys/dev/serial/sio/sio.c:2165`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Note: an earlier draft of this fix.diff failed the first combined build (see _batch41/README.md); the shipped diff is the corrected, compile-clean version.