{
  "finding_id": "DF-4218",
  "verdict": "MECHANISM PROVEN on the guest kernel by deterministic replica of if_ae.c's exact callout/serializer protocol (DF-3715 family, ae instance; adapted from the PROVEN DF-3991 ale replica / DF-3935 age replica — identical protocol shape). ae(4) arms one NON-MP callout (callout_init, if_ae.c:1262) whose handler takes the driver serializer by hand and self re-arms (ae_tick: lwkt_serialize_enter :995 BLOCKING, callout_reset hz :997); every teardown stops it while HOLDING that serializer (ae_stop: ASSERT_SERIALIZED :225 + callout_stop :232; callers: ae_ioctl down :1220-1221, ae_init :799 — also reached from the ae_intr error path :770-775 in interrupt context —, ae_watchdog :983, ae_detach :1417, ae_suspend :1786, ae_shutdown :1801). DragonFly callout_stop is synchronous (kern_timeout.c:1091-1094 -> sync=1 -> ssleep 'costp' :920). Guest replica run (build.log/run.log): 'tick handler BLOCKED on our serializer (fired=148 ran=147) - entering callout_stop()' then NO 'callout_stop returned' line, ps shows the stopper D4/wchan costp, STILL_WEDGED_AFTER_30S; follow-on commands timed out (parked non-MP callback holds the mplock, system-wide degradation — same signature as the PROVEN DF-3991 run on this same guest kernel); serial console's last ae_replica line is the BLOCKED message; guest reset with-src afterwards and verified clean. ae-specific end-to-end trigger hardware-gated (no 1969:2048 device, if_ae not in kernel, /usr/src md5 429ba8f801876d3e7a39eca15612f3ed == audited tree) -> inconclusive per family convention.",
  "impact": "none",
  "reproduce": {
    "build": "scp -F dfbsd-qemu/config findings/poc/DF-4218/ae_replica.c dfbsd:/tmp/ ; vm.sh run_root 'mkdir -p /root/kmod/aesink && cp /tmp/ae_replica.c /root/kmod/aesink/ && printf \"KMOD= ae_replica\\nSRCS= ae_replica.c\\n\\n.include <bsd.kmod.mk>\\n\" > /root/kmod/aesink/Makefile && cd /root/kmod/aesink && make'",
    "run": "vm.sh run_root 'kldload /root/kmod/aesink/ae_replica.ko && sysctl kern.aereplica.arm=1' ; timeout 90 vm.sh run_root '(sysctl kern.aereplica.stop=1 &) ; sleep 8; dmesg | tail -4; ps -ax -o pid,stat,wchan,comm | grep costp' ; sleep 30 ; vm.sh run_root 'ps -ax -o pid,stat,wchan,comm | grep costp; echo STILL_WEDGED_AFTER_30S' ; then vm.sh reset with-src",
    "expected": "'ae_replica: tick handler BLOCKED on our serializer (fired=N ran=N-1) - entering callout_stop()'; NO 'callout_stop returned' line; ps shows the sysctl stopper thread D4/wchan=costp; STILL_WEDGED_AFTER_30S; serial console last ae_replica line is the BLOCKED message"
  },
  "kernel_refs": [
    "sys/dev/netif/ae/if_ae.c:1262",
    "sys/dev/netif/ae/if_ae.c:995",
    "sys/dev/netif/ae/if_ae.c:997",
    "sys/dev/netif/ae/if_ae.c:225",
    "sys/dev/netif/ae/if_ae.c:232",
    "sys/dev/netif/ae/if_ae.c:799",
    "sys/dev/netif/ae/if_ae.c:770",
    "sys/dev/netif/ae/if_ae.c:1221",
    "sys/dev/netif/ae/if_ae.c:1417",
    "sys/dev/netif/ae/if_ae.c:1786",
    "sys/kern/kern_timeout.c:1091",
    "sys/kern/kern_timeout.c:920",
    "sys/kern/lwkt_serialize.c:105"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "ae_replica.c",
    "Makefile",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}