{
  "finding_id": "DF-3775",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "The blockable filter in ahci_port_intr() (ahci.c:2596-2607) defers blocking error sources to the port thread when called with blockable==0 from ahci_intr() (ahci.c:2511-2513), but the DHRS error sub-path (ahci.c:2843-2852) jumps directly into process_error (ahci.c:2649-2807), which sleeps: ahci_port_stop (1s pwait), ahci_port_clo (1s), and for NCQ ahci_port_start (2s) + ahci_port_read_ncq_error (1s poll) - all executed in the PCI interrupt thread (DFly tsleep has no interrupt-context guard, sys/kern/kern_synch.c), descheduling it with the port lock held and stalling shared IRQ devices for seconds. Device-triggered latency/DoS only, bounded by pwait timeouts. Not reproduced: guest has no AHCI controller.",
  "exploit_chain": "",
  "evidence": "VERDICT.md; ahci.c:2596-2607 (filter) vs ahci.c:2843-2852 (bypass); blocking calls at ahci.c:2671-2719; ahci.c:3612-3632 + ahci_dragonfly.c:221-230 (softsleep=tsleep inside pwaits); sys/kern/kern_synch.c tsleep (no interrupt-thread guard)",
  "kernel_refs": ["sys/dev/disk/ahci/ahci.c:2596", "sys/dev/disk/ahci/ahci.c:2843", "sys/dev/disk/ahci/ahci.c:2851", "sys/dev/disk/ahci/ahci.c:2671", "sys/dev/disk/ahci/ahci.c:3626"],  "poc_changes": "No runtime PoC - requires real AHCI interrupt with device-raised D2H ERR while ST clear.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "notes": "Bounded (~5s worst case per occurrence) but repeatable; no memory unsafety. Same blockable-discipline that ahci_port_intr otherwise enforces carefully.",
  "recommended_fix": "In the DHRS error sub-path, when blockable==0 disable port interrupts (PREG_IE=0) and defer to the port thread (AP_SIGF_PORTINT) instead of goto process_error - mirroring the blockable_mask deferral.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Deferral patch authored; no AHCI hardware to validate against.",
  "fix_evidence": "fix.diff in this pack."
}