# DF-2917 VERDICT — REPRODUCED (sleepq wait API never blocks)

**status: reproduced / impact: dos / confidence: certain**

## Root cause

* `sleepq_add()` (subr_sleepqueue.c:275-276) interlocks the sleeper with
  domain `PDOMAIN_FBSD0 + queue*PDOMAIN_FBSDINC` → `td->td_wdomain =
  0x01000000` (kern_synch.c:446).
* `_sleepq_wait_begin()` (subr_sleepqueue.c:327) computes exactly that
  domain into a local variable **and never uses it** — the tsleep() calls
  at :331/:336 pass `tflags` (= `PINTERLOCKED`|`PCATCH`, param.h:326:
  0x400 — no domain bits).
* `tsleep()` (kern_synch.c:660-663) validates the interlock:
  `td->td_wdomain != (flags & PDOMAIN_MASK)` → `0x01000000 != 0` →
  `goto resume` → **immediate return without descheduling**.
* Every `sleepq_wait()`, `sleepq_wait_sig()`, `sleepq_timedwait()`,
  `sleepq_timedwait_sig()` (subr_sleepqueue.c:387-458) is affected.

The correct pattern exists in-tree: `tsleep(waddr, PCATCH |
PINTERLOCKED | PDOMAIN_UMTX, ...)` (kern_umtx.c:227).

## Evidence

| kernel | state | observation |
|---|---|---|
| #2 Sep 3 09:16:39 (DF-0139 mask + DF-2915 fix) | DF-2917 live | `round1 (nowake): sleepq_wait() returned ret=0 after 0 sbticks with NO wakeup issued` (run.log) |
| #3 Sep 3 09:26:13 (+ DF-2917 fix) | fixed | `round1: sleeper STILL BLOCKED after ~200 ticks with no wakeup - sleepq_wait() really sleeps`; broadcast wakes it; `round2 (broadcast): returned after 1 sbticks` (run.2.log) |

The no-wake round is decisive: nothing in the system could legitimately
wake the sleeper, yet on the unfixed kernel the "wait" returned instantly
with ret=0.

## Impact

For any FreeBSD-compat / Linux-KPI consumer module: every blocking wait
degenerates into an immediate return — callers busy-spin at kernel
priority (per-CPU livelock / DoS), timeouts return instantly as success,
and the wakeup-blocking contract of the API does not exist.  No memory
corruption.

## Fix validation

`fix.diff` (`tflags | domain` in both tsleep calls) — built as kernel #3
(kbuild3_fix2917.log, rc=0): the same trigger that returned in 0 ticks now
blocks ~200 ticks and wakes on broadcast within 1 tick.
**fix_status: fixed.**

## Reachability

Zero in-tree callers; the API exists for kld-loaded compat modules
(root-only).  Not reachable by unprivileged users.