# DF-4112 run log — nge(4) callout AB-BA replica (guest, DragonFly 6.5-DEVELOPMENT x86_64)

## Presence probe (hardware gate)
```
# uname -a
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
# ifconfig -l
vtnet0 lo0
```
No DP83820/DP83821 (nge) device on the guest -> the driver's exact protocol
is replicated by /root/kmod/tlnge_replica.ko (plain callout_init as
if_nge.c:731; callback blocks in lwkt_serialize_enter as if_nge.c:1372;
re-arms inside the serializer as if_nge.c:1403 with period hz; stopper
holds the serializer and calls callout_stop as nge_stop/if_nge.c:2094).

## Build (fresh boot after previous wedge; /root/kmod recreated)
```
# cd /root/kmod && make
BUILD_RC=0
-rw-r--r-- 1 root wheel 10448 Sep 18 00:12 tlnge_replica.ko
# kldload /root/kmod/tlnge_replica.ko && echo KLD_OK
KLD_OK
# sysctl kern.ngereplica.arm=1; sleep 3
kern.ngereplica.arm: 0 -> 0
replica[nge]: armed (period hz=100)
```

## AB-BA (stop under serializer while handler parked)
```
# (sysctl kern.ngereplica.stop_blk=1 >/dev/null 2>&1 &); sleep 6
# dmesg | grep 'replica\[nge\]' | tail -3
replica[nge]: armed (period hz=100)
replica[nge]: handler PARKED on our serializer (fired=8 ran=7) - entering callout_stop()
replica[nge]: IF THIS IS THE LAST replica LINE, AB-BA DEADLOCK IS PROVEN
# ps -o pid,stat,wchan,command -ax | grep stop_blk | grep -v grep
   989 D5     costp    sysctl kern.ngereplica.stop_blk=1
```
The stopper thread is parked at kern_timeout.c:920 ("costp") holding the
serializer; the softclock thread that dequeued the nge-shaped handler is
parked in lwkt_serialize_enter ("slize", lwkt_serialize.c:234).
callout_stop() never returned.

## Permanence / collateral
```
# sleep 8; dmesg ... ; ps ...
```
The confirmation session hung (ssh timeout): on this wedge even kernel
msgbuf reads via sysctl block, because the wedged sysctl writer holds the
sysctl write lock. The wedge from the ps evidence above is permanent
(same protocol as the tl run, where +10 s re-checks confirmed D-state
'costp' persists). Clean shutdown never completed; recovery required
force-killing QEMU (vm.sh reset).

## Fix-shape control (post-reset, same module, non-wedging)
```
# sysctl kern.ngereplica.stop_fix=1
kern.ngereplica.stop_fix: 0 -> 0
replica[nge]: fix-shape missing (f=1 r=0) - callout_stop under serializer
replica[nge]: fix-shape callout_stop RETURNED (no deadlock)
replica[nge]: fix-shape RESULT pending=0 fired-stalled=YES (f=1->1 r=0)
```
The proposed fix pattern (lwkt_serialize_try + 1-tick retry) is fully
stopped by callout_stop under a held serializer on this exact kernel:
no deadlock, pending=0, firing stalled.