# DF-4300 verdict

## Reproduced?
Not reproduced (`not_reproduced` — honest stochastic outcome, not a
refutation of the code pattern).

Empirical hammer: `vkbd_wedge.c` ran ~90,000 open("/dev/vkbdctl") →
write(2 scancodes) → close() cycles in forked children so that close
always raced the just-enqueued drain task (the exact precondition for
the missed wakeup). No close blocked; the window between the
`while (state->ks_flags & TASK)` test (vkbd.c:307) and tsleep insertion
proved too narrow to hit in that many attempts on this 6-vCPU guest.

## Root cause (path:line)
- `sys/dev/misc/vkbd/vkbd.c:307-308` — check-then-sleep, no interlock.
- `sys/dev/misc/vkbd/vkbd.c:627-632` — task clears TASK + wakeup
  unconditionally after `kbd_intr()`.
- `sys/kern/kern_device.c:119-121,174-189` — vkbd dev_ops flags 0 →
  `d_close` dispatched under the mplock.
- `sys/kern/kern_synch.c` — `tsleep()` contains no mplock release, so a
  blocked close holds the mplock.

## Impact if hit
The closing thread sleeps holding the mplock → all non-MPSAFE device
entry points system-wide block → broad device-I/O stall (disk/net on
any non-MPSAFE drivers), recoverable only by signalling the sleeper
(PCATCH makes tsleep return; the loop then re-checks TASK, which is now
clear, and close completes). Root-triggered (the /dev/vkbdctl node is
0600 root:wheel), narrow window → Low severity, speculative confidence.

## Fix
Interlocked sleep around the TASK check (see fix.diff).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.