# DF-4218 — ae(4) tick callout vs ae_stop(): synchronous callout_stop under the serializer = AB-BA wedge (DF-3715 family)

`sys/dev/netif/ae/if_ae.c` — pass 2 (GLM 5.3).  DF-3715 (em, PROVEN) /
DF-3760 (alc) / DF-3776 (jme) / DF-3935 (age, PROVEN) / DF-3991 (ale,
PROVEN) family instance for ae(4).

## Build

```
scp -F dfbsd-qemu/config findings/poc/DF-4218/ae_replica.c dfbsd:/tmp/
vm.sh run_root 'mkdir -p /root/kmod/aesink && cp /tmp/ae_replica.c /root/kmod/aesink/ && \
  printf "KMOD= ae_replica\nSRCS= ae_replica.c\n\n.include <bsd.kmod.mk>\n" > /root/kmod/aesink/Makefile && \
  cd /root/kmod/aesink && make'
```

Builds clean with `-Werror` (full log in build.log).

## Run  (WEDGES THE GUEST BY DESIGN — reset with `vm.sh reset with-src` afterwards)

```
vm.sh run_root 'kldload /root/kmod/aesink/ae_replica.ko && sysctl kern.aereplica.arm=1'
timeout 90 vm.sh run_root '(sysctl kern.aereplica.stop=1 &) ; sleep 8; dmesg | tail -4; ps -ax -o pid,stat,wchan,comm | grep costp'
sleep 30
vm.sh run_root 'ps -ax -o pid,stat,wchan,comm | grep costp; echo STILL_WEDGED_AFTER_30S'
vm.sh reset with-src
```

## Expected output

```
ae_replica: tick handler BLOCKED on our serializer (fired=148 ran=147) - entering callout_stop()
ae_replica: IF THIS IS THE LAST ae_replica LINE, AB-BA DEADLOCK PROVEN (DF-3715 family / ae instance)
  1135 D4     costp    sysctl
STILL_WEDGED_AFTER_30S
```

No `callout_stop returned` line ever appears: the stopper (the sysctl
thread, playing ae_stop's role while holding the serializer) sleeps in
`costp` (kern_timeout.c:920 ssleep inside the synchronous callout_stop,
kern_timeout.c:1091) and the ae_tick replica — a NON-MP callout callback
parked in lwkt_serialize_enter (if_ae.c:995 shape) holding the mplock —
can never acquire the serializer.  AB-BA, permanent.

Observed live on the audit guest 2026-09-18; serial console shows the
BLOCKED line as the last ae_replica output; guest was reset with-src
afterwards.