{
  "finding_id": "DF-4350",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "REPRODUCED as a system-halting DoS through the production adv_intr of the shipped kernel binary, with the pure livelock isolated on a purpose-built kernel. Cyclic device-fed FWD chain (6->7->6): on the SHIPPED kernel the unbounded walk revisits completed slots and panics via the DF-4349 double-completion sink (panic.baseline.txt) - a hard device-fed crash. On a kernel rebuilt with ONLY the DF-4349 validation fix (kernel #3), the walk drops the revisited entries and NEVER TERMINATES: the dispatch kthread wedges inside production adv_run_doneq (no RETURNED marker), the console floods with 28,883 dropping completion lines, and the LRAM data-port service counter (kern.df43xx.dbg_hits, incremented by the #DB chip emulator on every production port access) climbs monotonically across six samples (9985 -> 24895 -> 360550 -> 365530 -> 425830 -> 433270, ~2500 port ops/s); kldunload is refused EBUSY because the thread is still spinning - exactly the filed interrupt-context livelock. On the kernel with BOTH fixes (kernel #2) the walk is budget-bounded: done queue walk exceeded 276 entries, stopping and adv_intr RETURNS after 4273 port services, guest alive. Termination of the walk is controlled solely by the device-written FWD byte (advansys.c:1043/:1068/:1114); no iteration bound exists in the unpatched driver - confirmed structurally and behaviorally.",
  "exploit_chain": "Corrupt/hostile AdvanSys LRAM done-queue FWD bytes forming a cycle -> production adv_run_doneq loop (crit section held in the real ISR) never sees ADV_QLINK_END -> shipped kernel: revisit panic via DF-4349 sink (hard crash); DF-4349-fixed kernel: infinite drop-loop = interrupt livelock / permanent kernel-thread wedge, watchdog-class DoS. Requires physical AdvanSys HBA with buggy/hostile firmware or a hostile SCSI peripheral; no unprivileged-user or remote path.",
  "evidence": "panic.baseline.txt (cyclic chain -> panic on shipped kernel), run.4349only-livelock.log (full serial: entering production adv_intr with cyclic FWD chain, 28883 drop lines, no RETURNED, dbg_hits climb, kldunload EBUSY), run.bothfixed.log + fix_run.log (budget break at ADV_MAX_TOTAL_QNG+ADV_MAX_SG_LIST=276, adv_intr RETURNED after 4273 services), run.log (condensed livelock capture)",
  "kernel_refs": [
    "sys/dev/disk/advansys/advansys.c:1043",
    "sys/dev/disk/advansys/advansys.c:1068",
    "sys/dev/disk/advansys/advansys.c:1071",
    "sys/dev/disk/advansys/advansys.c:1085",
    "sys/dev/disk/advansys/advansys.c:1114",
    "sys/dev/disk/advansys/advansys.c:1116",
    "sys/dev/disk/advansys/advlib.c:802"
  ],
  "poc_changes": "Replaced the seed userspace model with the production-handler KLD dispatch rig shared with DF-4349 (fabricated softc + watchpoint-emulated ASC LRAM + nm-resolved kernel adv_intr). Added scenario 4 (synchronous cyclic-chain dispatch) and scenario 6 (dedicated-kthread dispatch with heartbeat callouts and a kern.df43xx.dbg_hits counter that counts every emulated LRAM data-port access made by the spinning production walk) plus the two rebuilt-kernel variants that isolate the livelock (DF-4349 fix only) and validate the budget fix (both fixes).",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (6 cpus, 4GB); livelock run on rebuilt #3 (DF-4349-fix-only) Oct 15 15:11; fix run on rebuilt #2 (both fixes) Oct 15 15:00",
  "runtime_sec": 3300,
  "guest_dirty": 0,
  "build_cmd": "vm.sh run_root sh /root/df43xx/build.sh (rig KLD) and vm.sh run_root sh /root/fixes/build_fixed.sh 4349|both (kernel rebuilds)",
  "run_cmd": "vm.sh run_root sysctl -w kern.df43xx.go=6 then sample sysctl -n kern.df43xx.dbg_hits (livelock proof); go=4 for the synchronous variant",
  "code_hash": "9c695ff5010595bb6fa4e6bf63389821b2095410373f736efd3579b8e6ca9444",
  "notes": "Interaction mapped completely: baseline cyclic chain = panic via DF-4349s unvalidated completion (crash masks livelock); with DF-4349 fixed alone the exact filed livelock manifests (kthread wedged forever, ~2500 LRAM port ops/s, unkillable - in the real driver this loop runs inside adv_intr with the crit section held, i.e. a hard interrupt-context hang); with DF-4350s budget added the walk stops at 276 entries and service is restored. Heartbeat callout prints were starved by the wedged CPU + console flood; non-termination is proven by the missing RETURNED marker, six monotonic dbg_hits samples, 28,883 drop lines, and the EBUSY module-unload refusal. Guest reset to pristine with-src snapshot and left up.",
  "recommended_fix": "Budget the done-queue walk at ADV_MAX_TOTAL_QNG + ADV_MAX_SG_LIST iterations and break with a diagnostic when exceeded (a legitimate done queue can never be longer).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #2: Thu Oct 15 14:56:52 UTC 2026 (both fixes; budget present)",
  "fix_verdict": "On the shipped kernel the cyclic chain panics (DF-4349 sink); on the both-fixed kernel the identical dispatch logs adv9: done queue walk exceeded 276 entries, stopping (corrupt LRAM?) and adv_intr returns after 4273 LRAM data-port services, guest alive, control completions unaffected. baseline_reproduced=1 (system-halting), patched_reproduced=0.",
  "fix_evidence": "fix_run.log / run.bothfixed.log: done queue walk exceeded 276 entries + df43xx[4]: adv_intr RETURNED after 4273 data-port services; panic.baseline.txt for the baseline halt"
}