{
 "finding_id": "DF-4298",
 "status": "untested",
 "reproduced": 0,
 "impact": "none",
 "confidence": "likely",
 "verdict": "Skipped per contract (Low-severity lock-protocol finding). The lock-order inversion kbd_token -> kb_lock (kbd.c:802-808 via kbdsw.c:209-211; also kbd.c:191-221 kbd_register calling kbd_ioctl(KBADDKBD) under the token) versus kb_lock -> kbd_token (syscons.c:1630-1631 kbd_ioctl without the token -> atkbd.c:1113 default -> kbd.c:999 genkbd_commonioctl taking the token; vkbd.c VKBD_LOCK -> genkbd_commonioctl same shape) is statically certain as an AB-BA protocol violation, but manifesting it requires winning a narrow race between a privileged /dev/kbdN ioctl (or keyboard registration) and a ttyv console ioctl on the same kernel; no reliable deterministic trigger exists on the single-tenant guest, so no QEMU run was attempted and impact remains a potential two-thread wedge (DoS).",
 "exploit_chain": "",
 "evidence": "findings/poc/DF-4298/README.md (line-exact citations of both acquisition orders)",
 "kernel_refs": [
  "sys/dev/misc/kbd/kbd.c:802-808",
  "sys/dev/misc/kbd/kbd.c:191-246",
  "sys/dev/misc/kbd/kbd.c:999",
  "sys/dev/misc/kbd/kbdsw.c:203-216",
  "sys/dev/misc/syscons/syscons.c:1630-1631",
  "sys/dev/misc/kbd/atkbd.c:1113"
 ],
 "poc_changes": "no runnable PoC authored; static evidence only",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "",
 "run_cmd": "",
 "code_hash": "",
 "notes": "Low severity; deadlocks two threads (privileged ioctl vs unprivileged ttyv ioctl). Skipped per Phase V rules allowing Low findings to skip verification.",
 "recommended_fix": "Establish a single lock order: make genkbdioctl drop kbd_token before kbdsw dispatch (kb_lock already serializes) or require kbd_token as the outermost lock in the syscons/vkbd ioctl paths."
}