# DF-4046 — stge_stop() deadlocks against stge_tick (synchronous callout_stop under the driver serializer)

- **File:** `sys/dev/netif/stge/if_stge.c` (stge(4))
- **Severity:** Medium · **Confidence:** certain · stge-specific runtime hardware-gated; **mechanism PROVEN on the guest kernel** via protocol replica
- **Family:** DF-3715 (em, proven) / DF-4025 (re, proven) — callout AB-BA

## Build

```sh
cd /root/stgereplica && make      # bsd.kmod.mk module
```

## Run

```sh
kldload /root/stgereplica/stgereplica.ko
sysctl kern.stgereplica.arm=1     # arm the stge_tick replica (1-tick period)
sleep 2
(sysctl kern.stgereplica.stop=1 >/tmp/stop4046.out 2>&1 &)   # NEVER returns
sleep 6
dmesg | grep stgereplica | tail -4
ps -o pid,stat,wchan,command -ax | grep "stop=1" | grep -v grep
```

## Expected result (observed)

```
stgereplica: stge_tick parked on our serializer (fired=202 ran=201) - entering callout_stop()
stgereplica: IF THIS IS THE LAST stgereplica LINE, AB-BA DEADLOCK IS PROVEN
<<< console ends here — callout_stop() never returns >>>
...
43529 D0     costp    sysctl kern.stgereplica.stop=1   <- kern_timeout.c:920
    -1 B2     slize    (softclock 2)                   <- tick parked in
                                                            lwkt_serialize_enter
```

The observing shell itself never finishes its `sleep` (callout starvation);
the guest afterwards cannot even shut down cleanly and must be force-reset
(`vm.sh revert with-src && vm.sh up`).

## On real stge(4) hardware

`ifconfig stgeX down`, `SIOCSIFMTU`/`SIOCSIFCAP` reinit, Tx-underrun
force-init from the interrupt path (`if_stge.c:1438-1440`), detach,
suspend, or reboot — each holds the serializer through `stge_stop()` —
racing the 1 Hz `stge_tick` on another CPU wedges the kernel permanently:
two threads stuck (`costp` × `slize`), the interface serializer never
released, and the affected CPU's softclock stops delivering ALL callouts.

## Artifacts

`stgereplica.c`, `Makefile`, `build.sh`, `run.sh`, `build.log`, `run.log`,
`env.txt`, `fix.diff`, `VERDICT.md`, `manifest.json`, `verdict.json`.