{
  "finding_id": "DF-4613",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ips_timeout takes sc->queue_lock exclusively (ips.c:337) and, on watchdog expiry, calls sc->ips_adapter_reinit(sc,1) at ips.c:355 still holding it. The forced reinit issues config-sync/error-table commands whose completion it waits for with ips_timed_wait(...,0) - an infinite tsleep (ips_commands.c:722,743) that does not release lockmgr locks. The completion can only be delivered by ips_morpheus_intr/ips_copperhead_intr, which must first acquire the same queue_lock (ips.c:585/769) and therefore blocks forever; the sleeping softclock thread never wakes, never releases the lock, and all IPS I/O plus the watchdog wedge permanently. LK_CANRECURSE (ips_pci.c:154) cannot help cross-thread. This is the timer-path twin of DF-2163 (ioctl path) and needs no user action - only a card command hung ~100s, i.e. exactly the fault the watchdog exists to recover from; by construction the recovery can never complete. Not reproduced on the audit guest: no IBM ServeRAID PCI device exists there (env.txt) and QEMU has no device model for it, so the path cannot be instantiated; the static trace is complete and DF-2163 documents the identical lock/sleep inversion on real hardware.",
  "exploit_chain": "",
  "evidence": "VERDICT.md five-hop proof chain: ips.c:337 lock, ips.c:355 reinit under lock, ips_commands.c:722/743 tsleep(0), ips_commands.c:66-72 sole wakeup source, ips.c:585/769 interrupt handler blocked on same lock; kern_timeout.c:416-423 softclock is a thread (sleep mechanically legal, never terminates); env.txt (device absent)",
  "kernel_refs": [
    "sys/dev/raid/ips/ips.c:337",
    "sys/dev/raid/ips/ips.c:355",
    "sys/dev/raid/ips/ips.c:585",
    "sys/dev/raid/ips/ips.c:769",
    "sys/dev/raid/ips/ips.c:516",
    "sys/dev/raid/ips/ips_commands.c:722",
    "sys/dev/raid/ips/ips_commands.c:743",
    "sys/dev/raid/ips/ips_commands.c:47",
    "sys/dev/raid/ips/ips_pci.c:154"
  ],
  "poc_changes": "none - no PoC possible; QEMU cannot instantiate a ServeRAID controller (PCI 0x1014:0x01BD/0x002E/0x0250/0x9005). Verdict rests on the cited static trace and the mechanically identical DF-2163.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Additional degradation: reinit busy-waits DELAY(5000000)+up to 285x1s under queue_lock in the softclock thread before the deadlock even forms, starving all other callouts on that CPU. Related-but-distinct: DF-2163 (same inversion via ioctl, tsleep hz/10 loop, High because root-reachable at will); DF-4613 needs only a hardware stall. Guest env: ips driver linked in kernel (kldstat pci/ips) but zero ServeRAID PCI devices, /dev/ips* absent.",
  "recommended_fix": "Release queue_lock around the forced ips_adapter_reinit call in ips_timeout and give the ips_timed_wait calls in ips_clear_adapter helpers finite timeouts so a dead card cannot sleep forever.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline cannot be exercised on the QEMU/virtio guest (no ServeRAID device model exists upstream), so a patched-kernel A/B run is impossible. fix.diff releases the lock around the reinit and bounds both waits at 60s; it eliminates the inversion by construction (the interrupt handler can then acquire the lock and deliver the wakeup).",
  "fix_evidence": "fix.diff (ips.c: release/reacquire queue_lock around ips_adapter_reinit; ips_commands.c: ipssyn/ipsetc waits 0 -> 60*hz)."
}