{
  "finding_id": "DF-4327",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "REPRODUCED on the live guest kernel: protocol replica of sf_stop()/sf_stats_update() proves the DF-3715-family AB-BA deadlock in this drivers exact shape. With the serializer held, callout_stop() waits on costp (kern_timeout.c:923) for the 1Hz stat callback, which is itself blocked in lwkt_serialize_enter on that serializer (if_sf.c:1396). Stop thread observed permanently D4 wchan=costp; softclock thread wedged; guest required reset. Permanent hang of the ifnet serializer + a CPUs callout thread.",
  "exploit_chain": "ifconfig sf0 down / detach / abnormal-IRQ reinit racing the 1s stat timer -> stopper holds serializer + sleeps costp; callback sleeps on serializer: both wedge permanently; all callouts on that CPU stall (system-wide timer stall)",
  "evidence": "run.log (dmesg sequence fired=10 ran=9 BLOCKED + ps line 979 D4 costp sysctl kern.sfcal.stop=1), sf_callout_harness.c, build.log",
  "kernel_refs": [
    "sys/dev/netif/sf/if_sf.c:1344",
    "sys/dev/netif/sf/if_sf.c:1396",
    "sys/dev/netif/sf/if_sf.c:1421",
    "sys/kern/kern_timeout.c:1091",
    "sys/kern/kern_timeout.c:923"
  ],
  "poc_changes": "authored from scratch; adapted from the proven DF-3715 replica pattern; fixed an internal blocked-state detection bug (cumulative vs delta counters) between runs",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1200,
  "guest_dirty": 0,
  "build_cmd": "cd /root/kmod/sfcal && make SYSDIR=/usr/src/sys",
  "run_cmd": "kldload sf_callout_harness.ko && sysctl kern.sfcal.arm=1 && (sysctl kern.sfcal.stop=1 &) && ps -o pid,stat,wchan,command -ax | grep sfcal.stop",
  "code_hash": "c9c92a62a0efaa5b3b4963731b05973e46ba7642e2027ab9d7e1984ac4b86749",
  "notes": "guest wedged by design during run; reset with-src afterwards (clean)",
  "recommended_fix": "callout_stop_async() under the serializer + !IFF_RUNNING guard in sf_stats_update + callout_drain() in sf_detach after releasing the serializer",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix edits if_sf.c (hardware driver not present on guest); replica module cannot observe sys/ changes",
  "fix_evidence": "fix.diff authored (stop_async + RUNNING guard + drain)"
}