# DF-3029 verdict — NOT REPRODUCED in bounded stress (defect stands by analysis)

## Root cause (path:line)

`sys/vfs/fuse/fuse_vnops.c:2013-2023` (fuse_io_thread) vs
`sys/vfs/fuse/fuse_vnops.c:1682-1693` (fuse_vop_strategy producer:
spin_lock; TAILQ_INSERT; spin_unlock; wakeup).

Classic lost wakeup: the consumer's queue-empty decision is not interlocked
with its tsleep.  If the producer's wakeup() lands in the instructions
between the helper's `spin_unlock` (after observing an empty queue) and its
`tsleep`, the wakeup is dropped; the queued bio is never processed and its
waiter sleeps forever (user read in biowait, or pageout via UIO_NOCOPY
strategy).  Only a subsequent fuse I/O on the same mount re-wakes the helper;
an otherwise-idle mount hangs permanently.

## Verification attempt (honest)

8 threads x 240s of randomized 4K preads against a 16MB fuse file (worst-case
queue churn, ~2.4M reads/s sustained): 585,939,514 ops, zero stalls.  The
window is ~tens of nanoseconds against a ~400ns+ syscall loop; a hit is
expected only at very low probability per idle-transition (hours-to-days of
hammering).  Classification: not_reproduced (bounded run), finding confidence
likely (the code defect is unambiguous; compare the correct interlocked
pattern in fuse_ipc.c:171-175).

## Fix

`fix.diff` restructures the loop to `tsleep_interlock` + recheck under the
spinlock + `tsleep(PINTERLOCKED)`, and also rechecks `fmp->dead` under the
lock for a clean unmount exit.  Patched module passes a 120s no-regression
smoke (290,965,533 reads, no stall, same throughput).  fix_status=not_testable
(the race itself cannot be triggered deterministically).