{
  "finding_id": "DF-4064",
  "verdict": "inconclusive",
  "impact": "none",
  "verdict_summary": "Mechanism PROVEN on the guest kernel by deterministic replica of if_fxp.c's exact callout/serializer protocol (non-MPSAFE callout_init:399 + blocking lwkt_serialize_enter in fxp_tick:1449 + self re-arm under serializer:1552 vs callout_stop under serializer in fxp_stop:1577): the fxp_stop-shaped stopper wedges permanently in 'costp' (kern_timeout.c:920) while softclock 5 wedges in 'slize' (lwkt_serialize.c:234) holding the MP lock. fxp-specific runtime is hardware/timing-gated: real fxp0 attached on QEMU i82557b and four adversarial hammer campaigns could not reach the park window (structural reason documented: the timer is armed from the fxp netisr CPU, whose softclock only runs when the ifnet queue is drained, i.e. the serializer is free; no path sleeps holding the serializer before callout_stop). Fix validated at protocol level (try + 1-tick retry: clean stop, pending=0, clean unload).",
  "reproduce": {
    "build": "guest: mkdir /root/fxpkmod /root/fxpkmod_fixed; push sources; cd /root/fxpkmod && make; cd /root/fxpkmod_fixed && make",
    "run": "kldload /root/fxpkmod/fxp_callout_replica.ko; sysctl kern.fxr.arm=1; sysctl kern.fxr.stop_blk=1  # never returns; console marker + ps costp/slize",
    "expected": "console: 'fxr: IF THIS IS THE LAST fxr LINE, AB-BA DEADLOCK IS PROVEN' then silence; ps: stopper D0 costp, softclock 5 B5 slize"
  },
  "kernel_refs": [
    "sys/dev/netif/fxp/if_fxp.c:399",
    "sys/dev/netif/fxp/if_fxp.c:1441",
    "sys/dev/netif/fxp/if_fxp.c:1449",
    "sys/dev/netif/fxp/if_fxp.c:1552",
    "sys/dev/netif/fxp/if_fxp.c:1568",
    "sys/dev/netif/fxp/if_fxp.c:1577",
    "sys/dev/netif/fxp/if_fxp.c:738",
    "sys/dev/netif/fxp/if_fxp.c:1651",
    "sys/dev/netif/fxp/if_fxp.c:2078",
    "sys/kern/kern_timeout.c:920",
    "sys/kern/kern_timeout.c:1091",
    "sys/kern/lwkt_serialize.c:234"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "run.log", "run.patched.log",
    "build.log", "build.fixed.log", "env.txt",
    "fxp_callout_replica.c", "fxp_callout_replica_fixed.c",
    "Makefile", "Makefile.fixed", "build.sh", "run.sh",
    "boot-fxp-full.log", "guest_pre_reset.txt",
    "fxp_race.sh", "fxp_race2.sh", "fxp_race3.sh", "fxp_race4.sh",
    "vm_fxp.sh", "fix.diff", "manifest.json", "verdict.json"
  ]
}