{
  "finding_id": "DF-3922",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Mechanics certain, manifestation racy. DragonFly callout_stop() sleeps without timeout waiting for an in-progress callback (kern_timeout.c:910-921). hpt_timeouts first action is lock_driver() (entry.c:2629); fOsCommandDone calls callout_stop on the same callout while holding driver_lock (entry.c:2910, all completion contexts hold it). Concurrent fire => CPU0 sleeps in costp holding driver_lock, CPU1 sleeps acquiring it: permanent wedge of the controller, its DPC worker and - because the SIM shares &sim_mplock (entry.c:2047) - potentially all legacy-locked CAM I/O. Not reproducible on the audit guest (no RR1820 hardware).",
  "exploit_chain": "sustained IO on RR1820 -> command completion racing its 20 s timeout -> AB-BA sleep deadlock -> unkillable storage wedge (DoS)",
  "evidence": "VERDICT.md: lock/callout order trace with kern_timeout.c:920 ssleep and entry.c:2629/2910",
  "kernel_refs": [
    "sys/dev/raid/hptmv/entry.c:2629",
    "sys/dev/raid/hptmv/entry.c:2910",
    "sys/kern/kern_timeout.c:1091",
    "sys/kern/kern_timeout.c:920"
  ],
  "poc_changes": "n/a (fresh pack)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "hardware: sustained IO; race completion vs 20 s timeout",
  "code_hash": "",
  "notes": "Standard LLDD timeout-lock inversion; also note hptmv hijacks CAMs ccb_h.timeout_ch callout for its private timeout (entry.c:2669/2865), making the synchronous-stop semantics load-bearing.",
  "recommended_fix": "hpt_timeout must not sleep on driver_lock (LK_NOWAIT + requeue), removing the AB-BA against callout_stop under the lock",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff converts hpt_timeout to LK_NOWAIT+requeue; cannot validate without hardware",
  "fix_evidence": "fix.diff in this pack; never applied to sys/"
}