{
  "finding_id": "DF-3850",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Mechanism PROVEN on the guest kernel on the FIRST attempt by deterministic replica of if_dc.cs exact callout/serializer protocol; dc-specific runtime hardware-gated (inconclusive per family convention). dc_tick (sys/dev/netif/dc/if_dc.c:2717-2792) is the callback of a PLAIN (non-MPSAFE) callout (callout_init at :1847 -> callback executes under the Giant MP lock, kern_timeout.c:583) and does a BLOCKING lwkt_serialize_enter(ifp->if_serializer) at :2725 with self re-arm at :2786-2789; dc_stop() tears it down with callout_stop() at :3489 while holding that same serializer (callers: dc_detach :2213, dc_intr :2949, dc_init :3196, dc_watchdog :3468, dc_shutdown :3546, dc_suspend :3564); DragonFly callout_stop synchronously waits for an INPROG callback (kern_timeout.c:1091 -> :859-932, ssleep costp at :920). A tick dequeued and parked on the serializer therefore deadlocks against the stopper (AB-BA). Kernel-module replica on the guest: with the dc-shaped handler parked, callout_stop NEVER returned - stopper observed D1/wchan costp (pid 1530), softclock 0 observed B0/wchan slize holding the MP lock (non-MPSAFE callout, aggravation over the em/emx/alc/jme/msk family members which use callout_init_mp), serial console shows fired=21 ran=20 then the terminal marker line. The wedge survived a clean shutdown attempt (guest could not power off; qemu SIGKILL + snapshot revert required). Fix-shape validation on a fresh guest with the exact fix.diff protocol (lwkt_serialize_try + 1-tick retry): callout_stop returned in 3.09s with callout_pending()==0 after 318 fires / 308 retries / 0 parks - deadlock eliminated, timer truly unloaded.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3850/VERDICT.md; run.log (session transcript: D1 costp stopper + B0 slize softclock 0 + shutdown-wedge note + fix-shape run); build.log (module built clean under -Werror, BUILD ok); fix_validation.log (fixed-shape replica: callout_stop RETURNED, pending=0, 3.09s); dfbsd-qemu/boot.log serial markers; fix.diff (try-enter + 1-tick retry for dc_tick)",
  "kernel_refs": [
    "sys/dev/netif/dc/if_dc.c:1847",
    "sys/dev/netif/dc/if_dc.c:2725",
    "sys/dev/netif/dc/if_dc.c:2786",
    "sys/dev/netif/dc/if_dc.c:3489",
    "sys/dev/netif/dc/if_dc.c:2213",
    "sys/dev/netif/dc/if_dc.c:3196",
    "sys/dev/netif/dc/if_dc.c:3546",
    "sys/kern/kern_timeout.c:567",
    "sys/kern/kern_timeout.c:583",
    "sys/kern/kern_timeout.c:920",
    "sys/kern/kern_timeout.c:1091",
    "sys/kern/lwkt_serialize.c:105"
  ],
  "poc_changes": "No seed PoC. Authored dc_callout_replica.ko (out-of-tree kmodule replicating the dc callout protocol, including the plain/non-MPSAFE callout_init) because the guest has no dc hardware; the deadlock is in the generic protocol dc uses, so the replica exercises the identical kernel paths. dc_callout_replica_fixed.ko validates the fix shape live.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "cd /root/kmod && make   (KMOD=dc_callout_replica SRCS=dc_callout_replica.c)",
  "run_cmd": "vm.sh run_root kldload /root/kmod/dc_callout_replica.ko; sysctl kern.dcreplica_arm=1; sleep 1; (sysctl kern.dcreplica_stop=1 >/dev/null 2>&1 &); sleep 6; ps -o pid,stat,wchan,command -ax | grep dcreplica_stop",
  "code_hash": "98d1a195afd0e5fcf2d74ed81fa940d6eee03c61c343c874b257e29ca99cbdab",
  "notes": "dc(4) instance of the DF-3715/3738/3760/3776/3806 AB-BA callout family, with an aggravating delta: dc_stat_timer is a non-MPSAFE callout, so the parked softclock thread holds the Giant MP lock - proven live (guest could not even shut down cleanly after the wedge). Triggers on dc hardware: ifconfig dcX down/up, MTU/media change while running, watchdog reinit, detach, suspend/resume, system shutdown. Guest reset to with-src snapshot after verification.",
  "recommended_fix": "Make dc_tick() non-blocking: lwkt_serialize_try() with a 1-tick callout_reset retry (validated live at protocol level).",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (git apply --check clean): dc_tick uses lwkt_serialize_try + 1-tick retry. Validated at protocol level on the guest with dc_callout_replica_fixed.ko (callout_stop returns, pending==0, zero parks over 318 fires while the serializer was held 3s). Driver-level validation impossible on this guest (no dc NIC).",
  "fix_evidence": "findings/poc/DF-3850/fix.diff; findings/poc/DF-3850/fix_validation.log"
}