{
 "finding_id": "DF-2916",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "denial_of_service",
 "confidence": "certain",
 "verdict": "Defect (1) mechanically proven: a consumer module using the documented sleepq_set_timeout() macro fails to compile against the stock kernel headers with exactly the two claimed undeclared identifiers - sleepqueue.h:118 expands to tick_sbt * (timo) and C_HARDCLOCK, neither of which exists anywhere in the DFly tree (build log: error: tick_sbt undeclared ... error: C_HARDCLOCK undeclared, both at sleepqueue.h:118). Defects (2)/(3) are arithmetically demonstrated from the code: :300 stores td->td_sqtimo = sbticks + sbt where sbticks is a plain 64-bit tick counter, so a FreeBSD-semantics 500ms sbt (0x08000000) becomes ~1.34M ticks (~15.5 days at hz=100), and the int64 timo narrows into tsleep int parameter at :331/:336. Zero in-tree callers (latent API); fix (macro in DFly terms) A/B validated: the consumer module COMPILES against the patched header.",
 "exploit_chain": "",
 "evidence": "sq16_build.log: two undeclared-identifier errors at sleepqueue.h:118",
 "kernel_refs": [
  "sys/sys/sleepqueue.h:117",
  "sys/kern/subr_sleepqueue.c:300",
  "sys/kern/subr_sleepqueue.c:331"
 ],
 "poc_changes": "none",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 10,
 "guest_dirty": 0,
 "build_cmd": "make (KMOD sq16 against KERNBUILDDIR)",
 "run_cmd": "make  -> fails to compile (the defect)",
 "code_hash": "4e805dbc05a84e34343a371ecb9ad7ec09cfef7ad1be3723e58f798f642f16b0",
 "notes": "compile-time defect proven; runtime unit-confusion/truncation latent (no in-tree users)",
 "recommended_fix": "define the macro in DFly terms (ticks) + clamp on the tsleep boundary",
 "fix_status": "fixed",
 "fix_verdict": "A/B: consumer module compiles against the patched header (SQ16-OK on fix kernel vs FAIL on stock).",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0
}