{
  "finding_id": "DF-4303",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Mechanism PROVEN on the guest kernel by deterministic replica of if_bfe.cs exact callout/serializer protocol; bfe-specific runtime hardware-gated (inconclusive per DF-3715 family convention). bfe_tick (sys/dev/netif/bfe/if_bfe.c:1486-1508) is a NON-MP callout (callout_init :323, armed hz :1386) whose callback BLOCKS in lwkt_serialize_enter (:1494) on the driver serializer and re-arms itself INSIDE it (:1497); bfe_stop tears it down with the SYNC callout_stop (:1522) while holding that same serializer. DragonFly callout_stop synchronously waits for an in-progress callback (sys/kern/kern_timeout.c:1091 -> :859-930, ssleep costp at :920). A dequeued callback parked on the serializer therefore deadlocks against the stopper (AB-BA): both threads wedge permanently, the interface serializer is never released, and the affected CPUs softclock thread stops delivering all callouts (observed ssh stall). bfe_stop is reached under the serializer from bfe_ioctl SIOCSIFFLAGS (:1449), bfe_detach (:441), bfe_shutdown (:475), and - reachable by unprivileged users - the TX-timeout watchdog chain bfe_start if_timer=5 (:1351) -> if_slowtimo (sys/net/if.c:1900-1912) -> bfe_watchdog (:1480) -> bfe_init (:1365), plus the bfe_intr error reinit (:1186). Kernel-module replica on the guest: stop under a held serializer with the bfe_tick-shaped handler parked -> callout_stop NEVER returns (caller D2 wchan costp, ps 1048 D2 costp sysctl kern.bferplica.stop_blk=1); positive control: the try-enter fixed shape is fully unloaded by callout_stop (returns, pending=0), validating the fix mechanism and showing the defect is the blocking-enter AB-BA, not a post-stop re-arm.",
  "exploit_chain": "Local unprivileged user sends UDP/TCP traffic through a bfe(4) interface whose link is stalled (or waits for the 1 Hz tick race during any interface reinit): bfe_start sets if_timer=5, the TX watchdog fires bfe_watchdog -> bfe_init -> bfe_stop which holds the serializer and enters callout_stop while bfe_tick is parked on that serializer -> both threads sleep forever -> interface permanently wedged + one CPUs callout pipeline dead (system-wide timer starvation). Availability only; no memory corruption, no uid=0 route.",
  "evidence": "findings/poc/DF-4303/VERDICT.md (path:line trace + interleaving); run.log (replica session: bferplica[blk]: bfe_tick handler BLOCKED on our serializer (fired=16 ran=15) - entering callout_stop() then silence; ps 1048 D2 costp sysctl kern.bferplica.stop_blk=1; control callout_stop RETURNED (no deadlock), pending=0); build.log (module built on guest BUILD_RC=0, -Werror clean); env.txt (no Broadcom PCI, hw.bfe unknown, guest src md5 == audited tree); fix.diff (try-enter bfe_tick, patch --dry-run clean)",
  "kernel_refs": [
    "sys/dev/netif/bfe/if_bfe.c:323",
    "sys/dev/netif/bfe/if_bfe.c:1386",
    "sys/dev/netif/bfe/if_bfe.c:1494",
    "sys/dev/netif/bfe/if_bfe.c:1497",
    "sys/dev/netif/bfe/if_bfe.c:1522",
    "sys/dev/netif/bfe/if_bfe.c:1365",
    "sys/dev/netif/bfe/if_bfe.c:1480",
    "sys/dev/netif/bfe/if_bfe.c:1186",
    "sys/dev/netif/bfe/if_bfe.c:1351",
    "sys/kern/kern_timeout.c:859",
    "sys/kern/kern_timeout.c:920",
    "sys/kern/kern_timeout.c:1091",
    "sys/kern/lwkt_serialize.c:105",
    "sys/net/if.c:1900"
  ],
  "poc_changes": "No seed PoC (finding new in pass 2). Authored bfe_tick_replica.ko (out-of-tree kmodule replicating bfes EXACT protocol: non-MP callout_init, hz self re-arm inside the serializer, blocking lwkt_serialize_enter) because the guest has no BCM4401 hardware and QEMU cannot emulate one; the deadlock lives in the generic protocol bfe uses, so the replica exercises the identical kernel paths (kern_timeout.c callout_stop sync wait vs lwkt_serialize_enter sleep).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "build_cmd": "cd /root/kmod && make",
  "run_cmd": "vm.sh run_root kldload /root/kmod/bfe_tick_replica.ko; sysctl kern.bferplica.arm=1; sysctl kern.bferplica.stop_fixed=1; (sysctl kern.bferplica.stop_blk=1 &); sleep 10; dmesg | grep bferplica; ps -o pid,stat,wchan,command -ax | grep stop_blk",
  "code_hash": "288f6b4362278034a3e0676f59508bbd03adc6a9a686b6a2350bfe6525460d13",
  "notes": "DF-3715 family instance with bfe-specific flavor (non-MP callout + hz re-arm inside the serializer). Guest reset to with-src snapshot after the wedge (the D2 costp thread + wedged softclock thread are unsurvivable; kldunload would also deadlock). Control run validated the fix shape on this kernel before the destructive test.",
  "recommended_fix": "bfe_tick: replace the blocking lwkt_serialize_enter with lwkt_serialize_try (skip work this tick on failure) and move the hz self re-arm outside the serializer - exactly the fix merged for em(4) in DF-3715; see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (patch -p1 --dry-run clean); the fixed try-enter shape IS the stop_fixed positive control, which returns cleanly with pending=0 on this guest kernel (mechanism validated); the driver-level diff cannot be runtime-tested without BCM4401 hardware.",
  "fix_evidence": "findings/poc/DF-4303/fix.diff; run.log bferplica[fixed]: callout_stop RETURNED (no deadlock), pending=0"
}