{
  "finding_id": "DF-4109",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Mechanism PROVEN on the guest kernel by deterministic replica of if_tl.cs exact callout/serializer protocol; tl-specific runtime hardware-gated (inconclusive per family convention, as DF-3715). tl_stats_update (sys/dev/netif/tl/if_tl.c:1666-1674) is the callback of a plain-callout_init (if_tl.c:1197) 1 Hz timer (if_tl.c:1981) that BLOCKS in lwkt_serialize_enter (if_tl.c:1671) and re-arms itself inside the serializer (if_tl.c:1722); tl_stop() (if_tl.c:2121) tears it down with callout_stop() while the caller holds that same serializer (tl_ioctl :2062, tl_init :1916, tl_watchdog :2103, tl_detach :1258, tl_intvec_adchk :1571). DragonFly callout_stop synchronously waits for an in-progress callback (kern_timeout.c:1091 -> ssleep costp at :920), so a parked callback deadlocks against the stopper (AB-BA): both threads wedge permanently, the interface serializer is never released, and the affected CPUs softclock thread stops delivering all callouts. Kernel-module replica on the guest: stop under a held serializer with the tl-shaped handler parked -> callout_stop NEVER returned (thread D1 wchan costp, permanent at +10s); negative control (stop without serializer) returned pending=0; fix-shape control (lwkt_serialize_try + 1-tick retry, the proposed fix) is fully unloaded by callout_stop under the serializer on this kernel (pending=0, firing stalled) - fix mechanism validated. Collateral observed: post-wedge sysctl access hangs (sysctl write lock held by the wedged writer) and clean shutdown never completes.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4109/run.log (decisive lines: handler PARKED on our serializer (fired=4 ran=3) - entering callout_stop() then marker then silence; ps 1603 D1 costp; fix-shape callout_stop RETURNED ... pending=0 fired-stalled=YES); build.log (BUILD_RC=0, -Werror); VERDICT.md; fix.diff (try-enter + 1-tick retry)",
  "kernel_refs": [
    "sys/dev/netif/tl/if_tl.c:1197",
    "sys/dev/netif/tl/if_tl.c:1671",
    "sys/dev/netif/tl/if_tl.c:1722",
    "sys/dev/netif/tl/if_tl.c:1981",
    "sys/dev/netif/tl/if_tl.c:2121",
    "sys/dev/netif/tl/if_tl.c:2062",
    "sys/dev/netif/tl/if_tl.c:1916",
    "sys/dev/netif/tl/if_tl.c:2103",
    "sys/dev/netif/tl/if_tl.c:1258",
    "sys/dev/netif/tl/if_tl.c:1571",
    "sys/kern/kern_timeout.c:920",
    "sys/kern/kern_timeout.c:1091",
    "sys/kern/lwkt_serialize.c:234"
  ],
  "poc_changes": "No seed PoC. Authored tlnge_replica.ko (out-of-tree module) replicating the exact tl protocol because the guest has no ThunderLAN hardware; the deadlock is in the generic protocol the driver uses, so the replica exercises identical kernel paths (plain callout_init, hz period, blocking enter, re-arm inside serializer, stop under serializer).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "cd /root/kmod && make",
  "run_cmd": "vm.sh run_root kldload /root/kmod/tlnge_replica.ko; sysctl kern.tlreplica.arm=1; sleep 3; (sysctl kern.tlreplica.stop_blk=1 >/dev/null 2>&1 &); sleep 6; dmesg | grep replica; ps -o pid,stat,wchan,command -ax | grep stop_blk",
  "code_hash": "594a6097b8dcfeb807d4daacceaf175455f5d9df544f188a0509f177a486d7d1",
  "notes": "Trigger on tl hardware: ifconfig tl0 down/up, SIOCSIFMTU/SIOCSIFFLAGS reinit, kldunload if_tl, or an adapter-check interrupt, while the 1 Hz stats tick fires. Narrow per-call window but every down/up cycles through it; cost is a permanent, un-shutdown-able wedge. Family parent: DF-3715 (em(4), mechanism proven on the same guest kernel).",
  "recommended_fix": "Make tl_stats_update() non-blocking: lwkt_serialize_try() with a 1-tick callout_reset retry (em_txgc_timer pattern).",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (try-enter + 1-tick retry) authored against the read-only sys/ tree, patch --dry-run clean. The fix MECHANISM is validated on this kernel by the modules fix-shape control (callout_stop under a held serializer returns and fully unloads the try-based handler: pending=0, firing stalled). The patched tl driver itself cannot be exercised without ThunderLAN hardware.",
  "fix_evidence": "findings/poc/DF-4109/fix.diff; findings/poc/DF-4109/run.log fix-shape section"
}