{
  "finding_id": "DF-4618",
  "poc_id": "DF-4618",
  "status": "untested",
  "reproduced": 0,
  "impact": "Multi-second per-CPU preemption blackout per I/O (missed ticks, soft lockups, uniprocessor system-wide stall); repeatable per command",
  "confidence": "likely",
  "attempts": 0,
  "guest_uname": null,
  "code_hash": null,
  "exploit_chain": [],
  "evidence": "Every imm_wait runs a no-sleep busy-poll microseq (up to 5,000,000 iterations for data/status phases); vpo_intr wraps the whole synchronous transaction in crit_enter/crit_exit, so the issuing CPU cannot switch threads for the full duration. A malicious ZIP emulator simply never asserts nBUSY. Drivers stated threat model. No ppbus hardware on the guest.",
  "kernel_refs": [
    "sys/dev/disk/vpo/immio.c:55",
    "sys/dev/disk/vpo/immio.c:57",
    "sys/dev/disk/vpo/immio.c:702",
    "sys/dev/disk/vpo/immio.c:713",
    "sys/dev/disk/vpo/immio.c:731"
  ],
  "verdict": "not_run: no ppbus hardware on guest; mechanism source-certain",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable",
  "fix_evidence": "cut spin ceilings 10x (short-term) + drop crit_Enter wrapper / sleepable wait (proper) in finding markdown"
}