# DF-3850 — dc(4) AB-BA callout deadlock (dc_stop vs dc_tick)

**Severity: Medium · confidence: certain (mechanism proven on guest) ·
hardware-gated at driver level (inconclusive per family convention)**

## What this is

`sys/dev/netif/dc/if_dc.c` — `dc_stop()` can deadlock the callout subsystem
against `dc_tick()` (AB-BA): `callout_stop()` synchronously waits for a
callback that is blocked on the very serializer the stopper holds.
DF-3715/3738/3760/3776/3806 family (em, emx, alc, jme, msk); dc(4) instance,
aggravated by dc's **non-MPSAFE** callout (parked softclock thread holds the
Giant MP lock).

## Reproduce (on the audit guest, or any DragonFly 6.x with /usr/src)

    ./build.sh          # build /root/kmod/dc_callout_replica.ko on the guest
    ./run.sh            # arm + fire the dc_stop shape in background;
                        # observe D1/costp stopper and B0/slize softclock 0

Success criterion (all observed on 2026-09-16, first attempt):

  * serial console: `dcreplica[stop]: tick INPROG and PARKED on the
    serializer (fired=21 ran=20)` followed by
    `IF THIS IS THE LAST dcreplica LINE callout_stop NEVER RETURNED`
    and permanent silence from the replica;
  * `ps`: stopper in state `D1` wchan `costp` (kern_timeout.c:920),
    `(softclock 0)` in state `B0` wchan `slize` (lwkt_serialize park);
  * guest can no longer shut down cleanly (MP lock held) — requires
    `vm.sh reset with-src`.

## Fix validation

`dc_callout_replica_fixed.c` + `fix_validation.log`: with the fix shape
(`lwkt_serialize_try` + 1-tick retry), `callout_stop()` returns in 3.09 s,
`callout_pending()==0` — no deadlock, timer genuinely stopped.

## Files

    dc_callout_replica.c        deadlock replica module (dc protocol)
    dc_callout_replica_fixed.c  fix-shape replica module
    build.sh / run.sh           exact commands
    build.log / run.log / fix_validation.log   full untrimmed logs
    fix.diff                    git-apply-able fix vs read-only sys/ tree
    VERDICT.md                  full narrative
    verdict.json                machine verdict