# DF-2942 VERDICT — `sysref_activate` accepts termination-in-progress objects (negative-space ambiguity)

## Finding

The sysref protocol uses the same negative refcount space for two
mutually-exclusive states:

- **initializing**: `sysref_alloc()` sets `refcnt = -0x40000000`
  (`kern_sysref.c:164`) and the caller later calls `sysref_activate()`,
  which adds `0x40000001` (`-0x40000000 -> +1`);
- **terminating**: `_sysref_put()`'s `1 -> -0x40000000` cmpset
  (`kern_sysref.c:323`) enters termination-in-progress, then calls
  `ops.terminate` (`:324`).

`sysref_activate()`'s only gate is
`KASSERT(count < 0 && count + 0x40000001 > 0)` (`kern_sysref.c:280-281`),
which is *satisfied* by a terminating object (`-0x40000000 + 0x40000001 =
+1 > 0`). There is no `SRF_TERMINATING` distinction, so an activate that
lands in the termination window (or any caller that re-activates a
terminating object) resurrects the object to `+1` while its class
teardown is concurrently executing.

## Reproduction (guest, stock INVARIANTS kernel #0)

`sysref_probe.c` (synthetic `sysref_class`, terminate callback mirroring
`devfs_cdev_terminate`'s protocol). Trigger A drives a full lifecycle and
calls `sysref_activate()` from *inside* the terminate callback,
deterministically simulating a racing misuser:

```
terminate#1 entry refcnt=-1073741824            <- termination-in-progress
DF-2942: sysref_activate() on TERMINATING obj, before=-1073741824
DF-2942: after activate refcnt=1 (RESURRECTED; kern_sysref.c:280 KASSERT passed, no diagnostic)
terminate#2 entry refcnt=-1073741824            <- SECOND termination
A: result term_count=2 refcnt=0
A: CONFIRMED DOUBLE TERMINATION
```
(`run.log:1-13`) — the layer accepted the activation with **zero
diagnostics on the INVARIANTS kernel** and then invoked the class
terminate callback a **second time**.

Run 1 (probe variant re-activating on *every* termination) shows the
unbounded form: 292 consecutive terminate re-entries with the object
bouncing `+1 <-> -0x40000000`, each cycle nesting
`sysref_put -> _sysref_put -> ops.terminate -> sysref_put`, until the
kernel stack exhausted (`run.1.unbounded.log`: `Fatal double fault`,
`panic: double fault`).

## Why this matters (impact ceiling)

For a real class the second terminate re-executes the teardown that
already ran once. For the only in-tree consumer (cdev,
`devfs_core.c:2487-2507`): `devfs_cdev_terminate` would call
`devfs_release_ops()` a second time (decrementing the ops refcount past
zero — `devfs_core.c:2666` has no floor either — and potentially freeing
the tracking struct twice), then `lockmgr(&devfs_lock, LK_RELEASE)` an
extra time (lock underflow), then a second terminal `sysref_put` — i.e.
a double-terminate converts directly into lock-count and refcount
corruption for the class. The unbounded variant is a guaranteed
stack-exhaustion panic (demonstrated).

**Attacker reachability: none in-tree today.** The only live
`sysref_activate` caller is `devfs_new_cdev` (`devfs_core.c:2443`),
invoked exactly once immediately after `sysref_alloc` — the single-call
discipline is trivially maintained. The hazard is latent: the layer
*permits* the misuse and even its INVARIANTS asserts bless it. Filed as
Info hardening, confidence certain on the mechanism, speculative on any
future exploit path.

## Kernel references

- `sys/kern/kern_sysref.c:278-285` — `sysref_activate` and the accepting
  KASSERT (`:280`)
- `sys/kern/kern_sysref.c:164` — initialization sets the same
  `-0x40000000` sentinel
- `sys/kern/kern_sysref.c:314-327` — termination entry
  (`1 -> -0x40000000` at `:323`, `ops.terminate` at `:324`)
- `sys/sys/sysref.h:107-118` — `struct sysref` flags: no TERMINATING bit
- `sys/vfs/devfs/devfs_core.c:2443` — the only in-tree activate call
- `sys/vfs/devfs/devfs_core.c:2487-2507` — real-class terminate that a
  double invocation corrupts

## Fix

Distinguish the two negative-space states with a flag (see `fix.diff`):
set `SRF_TERMINATING` on the `1 -> -0x40000000` transition, clear it in
`sysref_alloc`/`sysref_ctor`, and require
`(sr->flags & SRF_TERMINATING) == 0` in `sysref_activate`'s assert.
Fix authored post-verification; not build-validated (Info hardening
finding; the fix's observable effect is the new assert itself).