# DF-3829 — NVMM VMX: host NMIs swallowed while a vCPU is resident

File under audit: `sys/dev/virtual/nvmm/x86/nvmm_x86_vmx.c` (pass 2).

## What this pack contains

* `nvmm_drive.c` — raw-ioctl NVMM driver used for the whole pass-2 live
  verification campaign (exit-dispatcher tests, hostile state, hostile
  event injection, concurrent stress, vCPU-residency spin). It contains
  no exploit; it is a correctness/robustness exerciser for the
  guest->host boundary.
* `vctest5.c` — minimal machine/hva/gpa/vcpu/setstate reproducer used
  while debugging the ioctl harness (kept for reference).
* `send_nmi.py` — sends `nmi` to the guest via the QEMU monitor socket.
* `run.log` — full sequential sub-test output (tests A..H).
* `run.2.log` — full concurrent-stress output (6 vCPUs + 2 hammer
  threads, ~600k racing ioctls).
* `run.seq.log` — earlier sequential run (with the accidental
  garbage-instruction fuzz evidence).
* `nmi_ddb_evidence.txt` — live-captured serial-console evidence of the
  NMI trial (guest dropped to DDB from `vmx_vcpu_run+0x522`).
* `env.txt` — guest uname, compiler, NMI sysctls, /dev/nvmm mode.
* `fix.diff` — proposed fix for the swallowed-NMI window.

## Build (on the DragonFly guest)

    cc -O2 -o nvmm_drive nvmm_drive.c -I/usr/src/sys -lpthread

Prerequisites: `kldload nvmm` (requires VMX; on the audit guest the VM
was booted with `qemu-system-x86_64 ... -cpu host` and the host KVM has
`nested=Y`), and read access to `/dev/nvmm` (group `nvmm`).

## Run

    # sequential boundary tests (expect: rc=0, no kernel panic)
    ./nvmm_drive run

    # keep 6 vCPUs resident (for the NMI trial) and concurrent stress
    ./nvmm_drive spin 24 6
    ./nvmm_drive stress 15 6

    # NMI injection from the QEMU monitor (host side)
    python3 send_nmi.py

## Expected results

* `run`: every sub-test ends cleanly (HALTED / SHUTDOWN / INVALID),
  hostile injections are rejected with EINVAL or produce clean
  VMentry-failure exits, **the kernel never panics**.
* `stress`: all threads complete, system alive.
* NMI trial: see `nmi_ddb_evidence.txt` — under nested KVM the
  differential for the swallow window cannot be isolated (QEMU `nmi`
  hits all CPUs at once); verdict for DF-3829 is `inconclusive` live,
  root cause established by source analysis.