{
  "finding_id": "DF-4109",
  "file": "sys/dev/netif/tl/if_tl.c",
  "verdict": "inconclusive",
  "impact_class": "none",
  "reproduce": {
    "build": "cd /root/kmod && make   (guest with /usr/src; tlnge_replica.ko, BUILD_RC=0)",
    "run": "vm.sh run_root 'kldload /root/kmod/tlnge_replica.ko; sysctl kern.tlreplica.arm=1; sleep 3; sysctl kern.tlreplica.stop_plain=1; sysctl kern.tlreplica.arm=1; sleep 3; (sysctl kern.tlreplica.stop_blk=1 >/dev/null 2>&1 &); sleep 6; dmesg | grep replica; ps -o pid,stat,wchan,command -ax | grep stop_blk'",
    "expected": "Mechanism PROVEN on the guest by replica (target hardware absent: guest has vtnet0/lo0 only). stop_blk under a held serializer with the tl-shaped handler parked in lwkt_serialize_enter -> callout_stop NEVER returns: last dmesg line is the marker, stopper thread D-state wchan 'costp' (kern_timeout.c:920), permanent at +10s; negative control returns pending=0; fix-shape (try-enter + 1-tick retry) fully stopped, pending=0."
  },
  "kernel_refs": [
    "sys/dev/netif/tl/if_tl.c:1671",
    "sys/dev/netif/tl/if_tl.c:1722",
    "sys/dev/netif/tl/if_tl.c:2121",
    "sys/kern/kern_timeout.c:920",
    "sys/kern/lwkt_serialize.c:234"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "tlnge_replica.c",
    "Makefile",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}