# DF-2730 - Verification Verdict

**Status:** reproduced
**Impact:** denial_of_service
**Confidence:** likely

## Mechanism
lwkt_acquire spins forever on td->td_flags & (TDF_RUNNING|TDF_PREEMPT_LOCK) with no watchdog: if the owner cpu wedges with the thread flagged, the acquiring cpu burns 100% forever (LOOPMASK diagnostics are compiled out).

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain unbounded spin (wedge-family hardening). Converting the silent wedge into a diagnosable event requires policy (timeout length, panic vs degrade) - authored as a documented recommendation, no code change in this batch to avoid destabilizing the scheduler on speculation.

## Threat / reachability
Permanent cpu burn on a wedged owner; unrecoverable without reboot.

## Privilege escalation assessment
n/a (hardening)

## Fix
Documented recommendation (no fix.diff): add a bounded spin with kprintf escalation and a configurable panic after N seconds so wedged owners are diagnosable.

## Kernel references
- `sys/kern/lwkt_thread.c:1396`
- `sys/kern/lwkt_thread.c:1398`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)