DF-2750 PoC environment + full result transcripts =============================================== Guest: DragonFly dfbsd 6.5-DEVELOPMENT, QEMU/KVM, 6 vCPUs (hw.ncpu=6), serial console captured via dfbsd-qemu/vm.sh log. Stock kernel (baseline): DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (INVARIANTS build, unmodified sys/kern/kern_lock.c) Fixed kernel (validation): DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Aug 31 17:16:25 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (same tree + findings/poc/DF-2750/fix.diff applied to sys/kern/kern_lock.c, built with: cd /usr/src && make nativekernel KERNCONF=X86_64_GENERIC (1300s), installed with make installkernel, rebooted) Module: lkmc.ko, built in-guest: cd /usr/src/sys/modules/lkmc && make obj && make MD5 (lkmc.c) = 91ebb90f4be0a1b3aab77db4bde29a49 sha256(lkmc.c v3) = see verdict.json code_hash --------------------------------------------------------------------------- BASELINE - stock kernel #0, harness v3, 3 x 20000 rounds (dmesg transcript) --------------------------------------------------------------------------- lkmc: loaded (DF-2750 PoC, persistent threads) lkmc: rounds=20000 hits=19750 healed=19750 bad_count=0000000008000000 stuck=0 lkmc: DEFECT REPRODUCED: concurrent KERNTHREAD releases drove XMASK 2->0, no wakeup, waiter slept on a free lock lkmc: rounds=20000 hits=19756 healed=19756 bad_count=0000000008000000 stuck=0 lkmc: DEFECT REPRODUCED: concurrent KERNTHREAD releases drove XMASK 2->0, no wakeup, waiter slept on a free lock lkmc: rounds=20000 hits=19617 healed=19617 bad_count=0000000008000000 stuck=0 lkmc: DEFECT REPRODUCED: concurrent KERNTHREAD releases drove XMASK 2->0, no wakeup, waiter slept on a free lock Additional baseline runs with the functionally-identical v2 harness (same staging, same barrier, same hit condition; lifecycle differences only): lkmc: rounds=20000 hits=15857 healed=15857 bad_count=0000000008000000 stuck=0 lkmc: rounds=20000 hits=19739 healed=19739 bad_count=0000000008000000 stuck=0 lkmc: rounds=20000 hits=19647 healed=19647 bad_count=0000000008000000 stuck=0 lkmc: rounds=20000 hits=19760 healed=19760 bad_count=0000000008000000 stuck=0 Interpretation: * hits/rounds = fraction of races in which BOTH releasers took the blind multi-count decrement (each had read LKC_XMASK==2), driving the count 2 -> 0 without any single-count case executing. * bad_count is always exactly 0x08000000 == LKC_EXREQ2: zero exclusive count, zero shared count, stranded EXREQ2, LKC_SHARED never pre-set. * healed == hits: in every hit the parked waiter stayed asleep on the now-FREE lock and completed ONLY after the driver's manual wakeup(&lkmc_lk) - i.e. the kernel itself issued no wakeup. * stuck=0: no harness bail-outs; guest stayed healthy and responsive through all runs (each 20000-round run completes in ~0.13s). --------------------------------------------------------------------------- FIXED KERNEL - kernel #1 with fix.diff, 3 x 20000 rounds (dmesg transcript) --------------------------------------------------------------------------- lkmc: loaded (DF-2750 PoC, persistent threads) lkmc: rounds=1 hits=0 healed=0 bad_count=0000000000000000 stuck=0 lkmc: rounds=100 hits=0 healed=0 bad_count=0000000000000000 stuck=0 lkmc: rounds=20000 hits=0 healed=0 bad_count=0000000000000000 stuck=0 lkmc: rounds=20000 hits=0 healed=0 bad_count=0000000000000000 stuck=0 lkmc: rounds=20000 hits=0 healed=0 bad_count=0000000000000000 stuck=0 (plus one earlier 20000-round run with the v2 harness on the same fixed kernel: rounds=20000 hits=0 healed=0 stuck=0) Interpretation: with the multi-count decrement converted to a validated fcmpset retry, the loser of the race re-reads LKC_XMASK==1 and falls into the single-count case which performs the grant, clears EXREQ2/CANCEL, pre-sets SHARED, and issues wakeup(lkp). The waiter completes on its own in 100% of 60000+ staged races. Lost wakeup eliminated; no behavioral change in the uncontended/single-releaser path.