# DF-4685 — no-op `rcu_barrier()` lets `kldunload` unmap module text with armed `call_rcu` callbacks (Low, panic)

* **File:** `sys/dev/drm/amd/amdgpu/amdgpu_fence.c:69-73`
  (`amdgpu_fence_slab_fini`), with the defect itself in
  `sys/dev/drm/include/linux/rcutree.h:30` (stub) and the delay line in
  `sys/dev/drm/linux_rcu.c`.
* **Trigger:** `kldunload amdgpu` (root) within ~1 s of fence activity, or
  any module unload with pending `call_rcu`/`kfree_rcu` entries.
* **Reproduced:** fatal trap 12 (page fault) at the unmapped callback
  address, guest down (`panic.txt`).

## Reproduce (shared module with DF-4684)

```sh
cd /root/poc/DF-4684 && make -m /usr/share/mk KMODDIR=$PWD   # df4684.ko (STOCK headers)
kldload drm            # manual: module deliberately has NO MODULE_DEPEND (see df4684.c note)
kldload ./df4684.ko
sysctl kern.df4684_run=2       # arm: call_rcu + no-op rcu_barrier
kldunload df4684               # completes
sleep 4                        # ~1s later: Fatal trap 12 (panic.txt)
```

Expected (baseline): `Fatal trap 12: page fault while in kernel mode`,
faulting IP == the callback address printed at arm time; `db>` prompt.
Expected (patched kernel + patched-header module): `rcu_barrier()` blocks
until the callback runs; unload completes; guest survives (`run.fixed.log`).

See `VERDICT.md` (full narrative incl. the DF linker dependency-refcount
side-discovery that initially wedged the demo) and `fix.diff`.