# DF-3903 — sk(4) AB-BA callout deadlock: sk_stop() vs sk_tick()/sk_yukon_tick()

**File:** `sys/dev/netif/sk/if_sk.c` (pass 2, GLM 5.3)
**Family:** DF-3715 / 3738 / 3760 / 3776 / 3806 / 3850 (7th instance) —
this is the SysKonnect sk(4) member; aggravating delta (like dc): the
callout is **non-MPSAFE**.

## What to run (on the audit QEMU guest, root)

```sh
md5 /usr/src/sys/dev/netif/sk/if_sk.c          # aff2b52bf166e5ebcbe6354b1ce24e6d == audited tree
./build.sh                                      # sk_callout_replica.ko (+ _fixed.ko)
kldload /root/kmod/sk_callout_replica.ko
sysctl kern.skreplica_arm=1                     # arm the sk_yukon_tick-shaped 1-tick timer
sleep 1
(sysctl kern.skreplica_stop=1 >/dev/null 2>&1 &)   # sk_stop shape: NEVER RETURNS
```

## Expected

The background `sysctl` never returns. A second session shows the stopper
thread in state `D`, wchan `costp` (the synchronous `callout_stop()` wait,
`sys/kern/kern_timeout.c:920`), and one `(softclock N)` thread in state
`B`, wchan `slize` (parked in `lwkt_serialize_enter`). Serial console
(`dfbsd-qemu/boot.log`):

```
skreplica[arm]: sk_tick_timer armed (1 tick), waiting
skreplica[stop]: tick INPROG and PARKED on the serializer (fired=2 ran=1)
skreplica[stop]: IF THIS IS THE LAST skreplica LINE callout_stop NEVER RETURNED (AB-BA deadlock)
```

No further `skreplica` lines appear: `callout_stop()` never returned.
The wedge survives a clean shutdown attempt (the parked softclock thread
holds the Giant MP lock because `sk_tick_timer` is a **plain, non-MPSAFE**
callout, `if_sk.c:1311`); the guest must be force-reset.

The guest has no SysKonnect hardware, so the driver itself is exercised by
a kernel module (`sk_callout_replica.c`) that replicates if_sk.c's exact
callout/serializer protocol (same callout flavor, same blocking enter,
same unconditional self re-arm, same `callout_stop` under the serializer).
The deadlock is in that generic protocol, which the replica exercises
byte-for-byte on the live kernel.

## Fix-shape validation (fresh guest)

```sh
kldload /root/kmod/sk_callout_replica_fixed.ko   # lwkt_serialize_try + 1-tick retry (fix.diff shape)
sysctl kern.skrepfix_arm=1; sleep 1
(sysctl kern.skrepfix_stop=1 >/dev/null 2>&1 &)  # holds serializer 3s, then callout_stop
```

Expected (observed): `skrepfix[stop]: callout_stop RETURNED (fixed shape):
fired=312 ran=5 retry=307 pending=0` — under cross-CPU contention the tick
retries instead of parking and `callout_stop` returns.