# DF-4310 — ste(4) callout AB-BA (DF-3715 family) — evidence pack

Finding: `ste_stop()` / `ste_intr()` STATS_OFLOW path issue the synchronous
`callout_stop(&sc->ste_stat_timer)` while holding `ifp->if_serializer`, while
the 1 Hz non-MP `ste_stats_update` callback must first block in
`lwkt_serialize_enter()` on that same serializer (holding the MP lock) —
permanent AB-BA deadlock; secondary: the tick's in-body `callout_reset`
overrides a racing STOP and resurrects the timer after detach (UAF).

## Build (on the guest, /usr/src present)

    # copy ste_callout_replica.c + Makefile to /root/kmod on the guest
    cd /root/kmod && make           # -Werror clean, see build.log

## Run (on the guest)

    kldload /root/kmod/ste_callout_replica.ko
    sysctl kern.sterplica.arm=1
    sleep 2
    sysctl kern.sterplica.stop_fixed=1      # positive control: returns
    (sysctl kern.sterplica.stop_blk=1 &)    # NEVER returns -> wedge
    sleep 10; dmesg | grep sterplica | tail -8
    ps -o pid,stat,wchan,command -ax | grep stop_blk
    # guest now wedged (D4/costp thread + softclock thread + MP lock) — reset:
    #   vm.sh reset with-src

## Expected decisive output (observed, run.log)

    sterplica[fixed]: callout_stop RETURNED (no deadlock), pending=0
    sterplica[blk]: ste_stats_update handler BLOCKED on our serializer (fired=14 ran=13) - entering callout_stop()
    sterplica[blk]: IF THIS IS THE LAST sterplica LINE, AB-BA DEADLOCK IS PROVEN (ste_stats_update vs ste_stop)
    1076 D4     costp    sysctl kern.sterplica.stop_blk=1

## Contents

- `ste_callout_replica.c` / `Makefile` — protocol replica module
- `build.sh` / `build.log` — guest build (-Werror clean, BUILD_RC=0)
- `run.sh` / `run.log` — full session: presence probe, control, wedge, ps
- `env.txt` — guest uname, clean-reset confirmation
- `VERDICT.md` — full narrative with path:line trace
- `fix.diff` — try-enter + re-arm-outside fix (git-apply-able)
- `manifest.json`, `verdict.json`