# DF-4637 — vpoio: uninterruptible 500K/5M-iteration handshake spins run under vpo_intr's hard critical section

File: `sys/dev/disk/vpo/vpoio.c` (pass 2, GLM 5.3)
Family: DF-4618 (immio.c instance, just filed) — this is the **vpoio.c instance** of the
same family; distinct code, distinct spin sites, shared caller `crit_enter()` wrapper.

## Reproduce (requires hardware the audit guest does not have)

Build: nothing to build — the trigger is ordinary disk I/O.

Run (on a machine with a real or emulated parallel port, `ppc` attached, `kldload vpo`,
a ZIP drive behind it enumerating as `/dev/daN`):

```sh
# Malicious ZIP emulator: attach a parallel-port device emulator that answers
# the VP0 select/connect handshakes but then simply never asserts nBUSY during
# the data/status phases.
dd if=/dev/da1 of=/dev/null bs=512 count=1     # any I/O works
```

Expected (per source trace): each command phase wait spins up to 500,000 port reads
(`VP0_FAST_SPINTMO`), each completion-phase wait up to 5,000,000 (`VP0_LOW_SPINTMO`),
all inside `crit_enter()`/`crit_exit()` (vpo.c:215/323) — the issuing CPU runs with
preemption disabled and interrupts deferred for the full spin (order seconds per I/O on
LPC-class port I/O), unkillable, repeatable per command. Watchdog/soft-lockup messages,
missed timers, network RX drops on that CPU.

## Status

**untested** — the audit guest has no parallel-port hardware at all
(dmesg/pciconf empty for ppc/ppbus/lpt; `vpo.ko` is present but cannot attach).
Mechanism is source-certain: see VERDICT.md for the line-by-line trace.
Family convention: DF-4618 / DF-4508 (hardware-gated, `untested`, attempts 0).