{
 "finding_id": "DF-2877",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "dos",
 "confidence": "certain",
 "verdict": "kdmsg_iocom_reconnect (kern_dmsg.c:139-144) waits for the old reader/writer iocom threads with a non-PCATCH lksleep loop and, unlike kdmsg_iocom_uninit (:283-294), has NO fp_shutdown escape. The old reader parks inside fp_read() on the old peer socket and only re-checks KILLRX at loop top, so a silent-but-open peer pins it forever; the DIOCRECLUSTER caller then blocks in an UNKILLABLE kernel sleep (verified live: process in D state, wchan clstrkl, survives kill -9 - twice, once accidentally and once scripted) and the disk's iocom stays wedged for all future attaches. On a stock boot the 'hammer2 service' daemon DIOCRECLUSTERs every disk with a pipe (cmd_service.c:898), so any second connect to a connected-but-idle disk wedges. Fix kernel: attach #2 waits 10.49s, then completes normally.",
 "exploit_chain": "privileged local (needs disk open = SYSCAP_RESTRICTEDROOT): attach#1 holds peer socket open idle -> attach#2 wedges unkillably + disk iocom dead; release only by closing attach#1's fds",
 "evidence": [
  "run.log (pid in D2/clstrkl alive after kill -9: STILL_ALIVE_UNKILLABLE)",
  "VERDICT.md",
  "run.fix.log (10.49s then success)"
 ],
 "kernel_refs": [
  "sys/kern/kern_dmsg.c:139",
  "sys/kern/kern_dmsg.c:141",
  "sys/kern/kern_dmsg.c:143",
  "sys/kern/kern_dmsg.c:287",
  "sbin/hammer2/cmd_service.c:898"
 ],
 "poc_changes": "No seed; added dfpeer 'hold' mode (attach + park)",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 300,
 "guest_dirty": 1,
 "build_cmd": "cc -O -Wall -o /tmp/dfpeer dfpeer.c",
 "run_cmd": "sh run_f4.sh (root)",
 "code_hash": "e748ca2203c63d4fc7c412513eefcdf465800329f3e8ff3c36dbd9f5d0583722",
 "notes": "First observed accidentally when the boot daemon's pipes wedged two test attaches; then reproduced deterministically twice.",
 "recommended_fix": "Mirror kdmsg_iocom_uninit: 10s retry counter then fp_shutdown of the old msg_fp so the kill-wait always terminates",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Wed Sep  2 18:43:16 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (fix.diff applied, make nativekernel)",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "Fix kernel: second attach blocks 10.49s (retry+shutdown escape), then completes (BLK_OPEN reply error=0); no D-state process remains.",
 "fix_evidence": [
  "run.fix.log"
 ]
}