{
  "finding_id": "DF-3760",
  "file": "sys/dev/netif/alc/if_alc.c",
  "verdict": "inconclusive",
  "impact_class": "none",
  "reproduce": {
    "build": "cd /root/kmod && make",
    "run": "vm.sh run_root 'kldload /root/kmod/alc_callout_replica.ko; sysctl kern.alcreplica.arm=1; sleep 2; sysctl kern.alcreplica.stop_try=1; (sysctl kern.alcreplica.stop_blk=1 >/root/blk.log 2>&1 &); sleep 5; dmesg | grep alcreplica | tail -3'",
    "expected": "Mechanism PROVEN on the guest kernel by deterministic replica of if_alc.c's exact callout/serializer protocol; alc-specific runtime hardware-gated (inconclusive per family convention). alc_tick (sys/dev/netif/alc/if_alc.c:3408-3436) is an MP callout whose callback BLOCKS in lwkt_serialize_enter (:3414) on the driver serializer and self re-arms at hz (:3428); alc_stop tears it down with callout_stop (:3973) while holding that same serializer (ASSERT_SERIALIZED :3965); DragonFly callout_stop synchronously waits for an in-progress callback (sys/kern/kern_timeout.c:1091 -> _callout_cancel_or_stop sync=1, ssleep 'costp' at :923). A tick callback dequeued and parked on the serializer therefore deadlocks against the stopper (AB-BA): both threads wedge permanently (sysctl thread D-state wchan 'costp'), the interface serializer is never released, and the affected CPU's softclock stops delivering all callouts. Replica on the guest: stop under a held serializer with the alc_tick-shaped handler parked -> callout_stop NEVER returned; fix-shape control (try-enter + 1-tick retry) -> callout_stop returned, pending=0."
  },
  "kernel_refs": [
    "sys/dev/netif/alc/if_alc.c:1353",
    "sys/dev/netif/alc/if_alc.c:3414",
    "sys/dev/netif/alc/if_alc.c:3428",
    "sys/dev/netif/alc/if_alc.c:3965",
    "sys/dev/netif/alc/if_alc.c:3973",
    "sys/dev/netif/alc/if_alc.c:3580",
    "sys/dev/netif/alc/if_alc.c:2826",
    "sys/dev/netif/alc/if_alc.c:1615",
    "sys/dev/netif/alc/if_alc.c:3103",
    "sys/kern/kern_timeout.c:1091",
    "sys/kern/kern_timeout.c:923"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "alc_callout_replica.c",
    "Makefile",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}