{
 "finding_id": "DF-4303",
 "file": "sys/dev/netif/bfe/if_bfe.c",
 "verdict": "inconclusive (mechanism PROVEN on guest via bfe-protocol replica; bfe hardware absent)",
 "impact_class": "none (driver runtime gated) - local DoS on real bfe(4) hardware",
 "reproduce": {
  "build": "cd /root/kmod && make",
  "run": "vm.sh run_root 'kldload /root/kmod/bfe_tick_replica.ko; sysctl kern.bferplica.arm=1; sysctl kern.bferplica.stop_fixed=1; (sysctl kern.bferplica.stop_blk=1 &); sleep 10; dmesg | grep bferplica | tail -3; ps -o pid,stat,wchan,command -ax | grep stop_blk'",
  "expected": "Control: 'callout_stop RETURNED (no deadlock), pending=0'. AB-BA: last lines 'bferplica[blk]: bfe_tick handler BLOCKED on our serializer (fired=N ran=N-1) - entering callout_stop()' + 'IF THIS IS THE LAST bferplica LINE, AB-BA DEADLOCK IS PROVEN' and then NO further output; ps shows the sysctl thread in state D2 with wchan 'costp' (kern_timeout.c:920 sync wait). Guest must be reset afterwards (vm.sh reset with-src)."
 },
 "kernel_refs": [
  "sys/dev/netif/bfe/if_bfe.c:323",
  "sys/dev/netif/bfe/if_bfe.c:1386",
  "sys/dev/netif/bfe/if_bfe.c:1494",
  "sys/dev/netif/bfe/if_bfe.c:1497",
  "sys/dev/netif/bfe/if_bfe.c:1522",
  "sys/dev/netif/bfe/if_bfe.c:1365",
  "sys/dev/netif/bfe/if_bfe.c:1480",
  "sys/dev/netif/bfe/if_bfe.c:1186",
  "sys/kern/kern_timeout.c:920",
  "sys/kern/kern_timeout.c:1091",
  "sys/kern/lwkt_serialize.c:105",
  "sys/net/if.c:1900"
 ],
 "artifacts": [
  "README.md",
  "VERDICT.md",
  "bfe_tick_replica.c",
  "Makefile",
  "build.sh",
  "run.sh",
  "build.log",
  "run.log",
  "env.txt",
  "fix.diff",
  "manifest.json",
  "verdict.json"
 ]
}