DF-2953 — decisive runs (guest: DragonFly 6.5-DEVELOPMENT x86_64, QEMU/KVM,
stock INVARIANTS kernel #0 Thu Jul 2 06:02:54 UTC 2026 from with-src snapshot)

RUN 1 — BASELINE (stock kernel)
  setup:  /etc/rc.d/syslogd stop; sysctl kern.log_wakeups_per_second=100
  cmd:    /root/klog_sigio_race
  result: PANIC within ~1 second of launch (ssh session died mid-command;
          guest sat at db> prompt)
  Fatal trap 12: page fault while in kernel mode
  cpuid = 3; lapic id = 3
  fault virtual address   = 0x40
  fault code              = supervisor read data, page not present
  instruction pointer     = 0x8:0xffffffff8066212d   (pgsigio+0xcd)
  current process         = Idle        (softclock kernel thread)
  current thread          = pri 12
  Stopped at      pgsigio+0xcd:   movl    0x40(%rdx),%edx
  [full text: panic.txt]

RUN 2 — fix attempt 1 (lwkt_gettoken(&sigio_token) around pgsigio in
        logtimeout): rebuilt kernel #1 02:04:08 (subr_log.o recompiled,
        build.log:14546), same PoC -> PANIC again at the identical
        pgsigio+0xcd / fault 0x40 within seconds.  Root cause of failure:
        lwkt tokens are released when the holder blocks (kern/lwkt_token.c
        header comment) and pgsigio() blocks in lockmgr(&pg->pg_lock).
        [text: run2_brokenfix_panic.txt]

RUN 3 — fix attempt 2 (systemic 13-file pgsigio(struct sigio **) snapshot
        + crhold/PHOLD/pgref under shared sigio_token): rebuilt kernel
        #1 02:47:12, same PoC -> PANIC after ~5s:
        panic: assertion "count > 0" failed in sess_rele at kern_proc.c:909
        Trace: sess_rele <- pgrel <- pgsigio <- logtimeout <- softclock_handler
        i.e. a snapshotted pgrp still hit a destroy/destroy race; root cause
        not fully determined (suspected lwkt shared/exclusive token
        exclusion subtleties).  NOT SHIPPED.  Diff kept as
        fix.attempt2-systemic-sigio-ref.diff.unvalidated.

RUN 4 — FINAL FIX (driver-local struct lock sc_lock serializing
        logopen/logclose/logtimeout/FIOSETOWN/TIOCSPGRP accesses of
        sc_sigio; lockmgr lock, holdable across blocking):
  kernel: #1: Fri Sep  4 03:14:12/52 UTC 2026 (build6.log, 0 errors)
  setup:  /etc/rc.d/syslogd stop; sysctl kern.log_wakeups_per_second=100
  cmd:    timeout 300 /root/klog_sigio_race
  result: NO PANIC.  Guest survived the full 300 s hammer; the PoC exited
          normally at the timeout (pgrep after: 0 processes); load average
          during/after the run: 5.04 (race machinery fully exercised);
          guest still up and answering ssh.  dmesg tail shows only the
          PoC's own console noise.

Conclusion: baseline reproduces deterministically (<1 s of hammering);
validated fix eliminates it (300 s clean soak).  impact=panic (local DoS
from privileged klog fd holders; jail-amplified via DF-0190).