# DF-2969 - verification verdict

Status: **not_reproduced** | reproduced: 0 | impact: denial_of_service | confidence: speculative

Protocol violation confirmed statically; the claimed hang REFUTED live. The harness created a kthread that immediately kthread_exit()ed, then called suspend_kproc(dead_td, 0) - the log shows the full sequence (atomic_set_int on the parked thread = the stale write, wakeup/tsleep on a dead identity), but suspend_kproc RETURNED: the exit path clears or the allocator recycles td_mpflags before the while-test, so the unkillable-sleeper never materialized; a second suspend_kproc on a LIVE kthread also completed (kpsus_token not wedged). No in-tree trigger exists (finding itself says speculative). Fix (lwkt_hold/lwkt_rele bracket) compiled into the fix-all kernel.

## Evidence pointers
df2969_run.log: suspend_kproc returned?! + live suspend_kproc returned (kpsus_token not held?)

## Kernel references
- sys/kern/kern_kthread.c:188
- sys/kern/kern_kthread.c:194
- sys/kern/kern_kthread.c:200

## PoC changes vs the filing sketch
drove the exact claimed call shape (timo=0 on an exited kthread); hang did not occur

## Fix
recommendation: lwkt_hold/lwkt_drop bracket + TDF_EXITING re-check

fix status: not_testable

compile-validated in fix-all kernel

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.