{
  "finding_id": "DF-3738",
  "title": "callout_stop(&sc->timer) under main_serialize deadlocks against emx_timer's blocking lwkt_serialize_enter (AB-BA; DF-3715 em(4) twin) - mechanism PROVEN on guest via protocol replica",
  "verdict": "inconclusive_per_family_convention_mechanism_proven",
  "impact": "dos_mechanism_proven_on_guest_kernel",
  "reproduce": {
    "build": "cd /root/emxkmod && make   # KMOD replica of if_emx.c callout protocol",
    "run": "kldload emx_callout_replica.ko; sysctl kern.emxreplica.arm=1; sleep 2; sysctl kern.emxreplica.stop_gc=1; (sysctl kern.emxreplica.stop_blk=1 &); sleep 6; dmesg | grep emxreplica; ps -o pid,stat,wchan,command -ax | grep stop_blk",
    "expected": "console: 'handler BLOCKED on our serializer ... entering callout_stop() [emx_stop shape]' then SILENCE forever; ps: stopper D4 wchan=costp (kern_timeout.c:920); ps -ax: softclock 0 B0 wchan=slize (lwkt_serialize.c:234). Negative control stop_gc returns with pending=0. Fixed-shape stop_fixed returns pending=0 (fix validated at protocol level)."
  },
  "kernel_refs": [
    "sys/dev/netif/emx/if_emx.c:1914",
    "sys/dev/netif/emx/if_emx.c:1928",
    "sys/dev/netif/emx/if_emx.c:2030",
    "sys/dev/netif/emx/if_emx.c:1534",
    "sys/dev/netif/emx/if_emx.c:4196",
    "sys/dev/netif/emx/if_emx.c:2026",
    "sys/kern/kern_timeout.c:1091",
    "sys/kern/kern_timeout.c:920",
    "sys/kern/lwkt_serialize.c:234"
  ],
  "artifacts": [
    "emx_callout_replica.c", "emx_callout_replica_fixed.c", "build.sh",
    "run.sh", "build.log", "run.log", "env.txt", "fix.diff",
    "VERDICT.md", "README.md", "verdict.json", "manifest.json"
  ]
}