{
  "finding_id": "DF-2877",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "kdmsg_iocom_reconnect (kern_dmsg.c:139-144) waits for the old reader/writer iocom threads with a non-PCATCH lksleep loop and, unlike kdmsg_iocom_uninit (:283-294), has NO fp_shutdown escape. The old reader parks inside fp_read() on the old peer socket and only re-checks KILLRX at loop top, so a silent-but-open peer pins it forever; the DIOCRECLUSTER caller then blocks in an UNKILLABLE kernel sleep (verified live: process in D state, wchan clstrkl, survives kill -9 - twice, once accidentally and once scripted) and the disks iocom stays wedged for all future attaches. On a stock boot the hammer2 service daemon DIOCRECLUSTERs every disk with a pipe (cmd_service.c:898), so any second connect to a connected-but-idle disk wedges. Fix kernel: attach #2 waits 10.49s, then completes normally.",
  "exploit_chain": "privileged local (needs disk open = SYSCAP_RESTRICTEDROOT): attach#1 holds peer socket open idle -> attach#2 wedges unkillably + disk iocom dead; release only by closing attach#1s fds",
  "evidence": [
    "run.log (pid in D2/clstrkl alive after kill -9: STILL_ALIVE_UNKILLABLE)",
    "VERDICT.md",
    "run.fix.log (10.49s then success)"
  ],
  "kernel_refs": [
    "sys/kern/kern_dmsg.c:139",
    "sys/kern/kern_dmsg.c:141",
    "sys/kern/kern_dmsg.c:143",
    "sys/kern/kern_dmsg.c:287",
    "sbin/hammer2/cmd_service.c:898"
  ],
  "poc_changes": "No seed; added dfpeer hold mode (attach + park)",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 300,
  "guest_dirty": 1,
  "build_cmd": "cc -O -Wall -o /tmp/dfpeer dfpeer.c",
  "run_cmd": "sh run_f4.sh (root)",
  "code_hash": "e748ca2203c63d4fc7c412513eefcdf465800329f3e8ff3c36dbd9f5d0583722",
  "notes": "First observed accidentally when the boot daemons pipes wedged two test attaches; then reproduced deterministically twice.",
  "recommended_fix": "Mirror kdmsg_iocom_uninit: 10s retry counter then fp_shutdown of the old msg_fp so the kill-wait always terminates",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Wed Sep  2 18:43:16 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (fix.diff applied, make nativekernel)",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix kernel: second attach blocks 10.49s (retry+shutdown escape), then completes (BLK_OPEN reply error=0); no D-state process remains.",
  "fix_evidence": [
    "run.fix.log"
  ]
}