{
  "finding_id": "DF-2813",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Deterministically reproduced (3/3) on the 6-cpu stock guest: a thread blocked in objcache_get(oc, M_WAITOK) on cpu5 slept permanently (11 s observation window, wmesg=\"objcache_get\", TDF_TSLEEPQ=1, no PCATCH, timo=0) while 6 freed objects sat available in cpu0's loaded magazine (PROBE cpu0 -> OBJECT AVAILABLE vs PROBE cpu5 -> NULL on the same cache at the same instant). The positive control (RESCUE: filling both cpu0 magazines -> depot cycle -> wakeup(depot)) woke it in 0.000 s, proving the defect is exactly the remote per-cpu-magazine delivery path guarded by wakeup_mycpu on the putter's cpu. fix.diff (flush partial loaded magazine to the depot when depot->waiting && !cpucache->waiting) was validated on a rebuilt guest kernel #1: the sleeper now wakes at strand time (0.25 s, first poll tick) and the system ran normally. Unprivileged reachability: blocking write(2)/send(2) -> sosend_generic m_getl(M_WAITOK) (uipc_socket.c:1024) with the user-exhaustible nmbufs/nmbclusters-limited mbuf caches; the stuck thread is unkillable.",
  "exploit_chain": "unpriv user: (1) exhaust a cluster-limited mbuf cache via socket buffers on many sockets (nmbclusters ~ 66 MB of clusters / nmbufs smaller still); (2) victim/attacker thread issues a blocking write(2) on a socket whose mbuf allocation hits objcache_get(M_WAITOK) -> permanent non-interruptible sleep when the frees that follow land in remote partially-filled magazines (< 2*magcap accumulated per cpu, no rebalance timer - callout is #if 0); (3) kill -9 cannot reclaim the process; repeat to strand threads/fds/memory.",
  "evidence": [
    "run.log / run.2.log / run.3.log: 'STUCK for 1102 ticks (11 s), TDF_TSLEEPQ=1 wmesg=\"objcache_get\"' with 'PROBE cpu0 -> OBJECT AVAILABLE' and 'PROBE cpu5 -> NULL (exhausted)', then 'sleeper acquired 0.000 s after RESCUE'",
    "run.patched.log (kernel #1 with fix.diff): sleeper woke 0.25 s after STRAND, latency=100 ticks, clean DRAIN/DESTROY",
    "dmesg in run logs: 'Warning: objcache(ochang) exhausted on cpu5!' (kern_objcache.c:540) while ARM drained exactly ncpus*2*magcap+cluster_limit = 80 objects",
    "env.txt: DragonFly 6.5-DEVELOPMENT, hw.ncpu=6, nmbclusters=33296, source hashes"
  ],
  "kernel_refs": [
    "sys/kern/kern_objcache.c:547",
    "sys/kern/kern_objcache.c:550",
    "sys/kern/kern_objcache.c:647",
    "sys/kern/kern_objcache.c:660",
    "sys/kern/kern_objcache.c:682",
    "sys/kern/kern_objcache.c:700",
    "sys/kern/kern_objcache.c:1029",
    "sys/kern/uipc_mbuf.c:797",
    "sys/kern/uipc_socket.c:1024",
    "sys/kern/kern_synch.c:815",
    "sys/kern/kern_synch.c:1189"
  ],
  "poc_changes": "PoC authored from scratch (no seed existed). Iterations: ipifunc3_t callback signature needed (void*, int, struct intrframe*); thread sleep-state read via TDF_TSLEEPQ+td_wmesg instead of nonexistent td_state; private-struct reach-in replaced with a behavioral probe (IPI objcache_get(M_NOWAIT)+put pair per cpu) which is stronger evidence anyway; driver clock_gettime -> gettimeofday for DFly userland visibility.",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 140,
  "guest_dirty": 0,
  "build_cmd": "sh ~/ochang/build.sh  (make KMOD; cc -O2 -o ochang_drv ochang_drv.c)",
  "run_cmd": "sudo sh /home/maxx/ochang/run.sh   (kldload ./ochang.ko; ./ochang_drv; dmesg | tail -25; kldunload ochang)",
  "code_hash": "463f76e21d9d207de731c367f99e15dfca390012f6be36ba68721effef1fa64a",
  "notes": "Fix validation performed per contract on rebuilt kernel: baseline reproduced 3x on kernel #0; patched kernel #1 (uname in fix fields) shows the hang gone and normal mbuf operation over ssh. Guest was reset with-src afterwards and is up on stock kernel #0. Related-but-distinct: DF-2721 (kern_slaballoc z_RSignal) is a different lost-wakeup family; DF-0064 is stats-only.",
  "recommended_fix": "In objcache_put's hot path, when depot->waiting != 0 and no local waiter exists, flush the partially-filled loaded magazine to the depot full list (swap in a depot empty magazine) and wakeup(depot) so remote M_WAITOK sleepers can reach the objects; see fix.diff.",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Tue Sep  1 16:06:47 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Applied fix.diff to /usr/src in-guest, make -j6 nativekernel + installkernel, rebooted into kernel #1. Exact same PoC: baseline stuck 11 s with stranded objects; patched wakes at strand time (0.25 s / latency=100 ticks), probes both AVAILABLE, clean teardown, no regressions observed in mbuf-heavy ssh operation.",
  "fix_evidence": [
    "findings/poc/DF-2813/run.patched.log: '!!! sleeper woke unexpectedly after 0.25 s' + 'sleeper: started=1 got=1 latency=100 ticks' + clean DRAIN/DESTROY/unload",
    "findings/poc/DF-2813/run.log:baseline kernel #0 stuck behavior for contrast",
    "findings/poc/DF-2813/fix.diff: git-apply-able (verified --check against pristine sys/)"
  ]
}