# DF-2724 - Verification Verdict

**Status:** reproduced
**Impact:** none (hardening)
**Confidence:** likely

## Mechanism
The NTP PLL discipline variables (time_state, time_status, nsec_adj, hardpps-driven pps fields) are mutated by the hardclock/pps interrupt paths with no synchronization at all - kern_ntptime.c guards sys_ntp_adjtime/sys_ntptime with ntp_lock (kern_ntptime.c:155,308-411), but the clock paths that mutate the SAME state take nothing, so interleaved PLL transitions are possible.

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain by inspection (grep: no ntp_lock anywhere in kern_clock.c). A real fix needs lock-free/atomic redesign or moving the discipline under a token that hardclock can take from interrupt context - lockmgr(9) cannot be used there - so this pack carries a documented recommendation rather than a risky one-liner. Impact ceiling: transient timekeeping glitches, not memory safety.

## Threat / reachability
Unsynchronized NTP state machine transitions under concurrent adjtime/PPS events.

## Privilege escalation assessment
n/a (hardening)

## Fix
Documented recommendation (no fix.diff): serialize NTP PLL transitions with an lwkt token (interrupt-safe) instead of the current unsynchronized mutation; upstream FreeBSD shares this exposure.

## Kernel references
- `sys/kern/kern_clock.c:749`
- `sys/kern/kern_clock.c:1802`
- `sys/kern/kern_ntptime.c:308`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)