{
  "finding_id": "DF-4300",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "vkbd_dev_close() waits for the drain task with an un-interlocked check-then-sleep (vkbd.c:307-308 vs task-side clear+wakeup at :629-630); a wakeup landing between the flag test and tsleep() is lost and close sleeps forever. Because vkbds dev_ops is not D_MPSAFE, d_close runs under the kernel mplock and tsleep does not release it, so a hit pins the mplock system-wide until a signal. ~90k live open/write/close race cycles did not trigger it (window empirically very narrow) \u2014 filed speculative.",
  "exploit_chain": "",
  "evidence": "VERDICT.md; race harness vkbd_wedge.c (see ../logs) ran ~90k cycles with no stuck close",
  "kernel_refs": [
    "sys/dev/misc/vkbd/vkbd.c:307",
    "sys/dev/misc/vkbd/vkbd.c:629",
    "sys/kern/kern_device.c:119",
    "sys/kern/kern_device.c:174"
  ],
  "poc_changes": "Harness built and run; race window too narrow to hit",
  "attempts": 90000,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "fix_status": "untested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (interlocked sleep); not built (trigger not reproducible)",
  "fix_evidence": "fix.diff",
  "build_cmd": "cc -O2 -o vkbd_wedge vkbd_wedge.c",
  "run_cmd": "./vkbd_wedge",
  "code_hash": "",
  "notes": "Root-triggered only (/dev/vkbdctl is 0600 root:wheel). PCATCH allows signal recovery; wedge duration = until signal.",
  "recommended_fix": "Interlock the TASK check and tsleep (tsleep_interlock pattern) in vkbd_dev_close."
}