# DF-4784 - VERDICT

**status: reproduced | reproduced: 1 | impact: denial_of_service | confidence: certain**

Mechanism reproduced on real emulated hardware (QEMU sdhci-pci + sd-card; mmcsd0 256MB attaches natively). Using the DF-4783 rig (mmcrace.ko, extended with a resume action) to invoke the REAL mmcsd_suspend() method: after 'mmcrace: suspend -> 0' (suspend=1, worker killed, running==-1), mmcsd_strategy (:312-315) kept enqueueing every bio into sc->bio_queue with no consumer, no bound and no ENXIO: 96 concurrent dd readers (4MB each) were all accepted and left permanently blocked (vmstat 'b' column = 96; ~400MB+ of buffers/pages pinned; paging activity began) - the queue accepted everything thrown at it. device_resume (mmcsd_resume restarts the worker and suspend=0) proves the bios were queued rather than rejected. Ceiling is kernel-memory exhaustion under sustained load - already witnessed live during the DF-4783 session as 'panic: malloc limit exceeded' with a consumerless queue; on this rig the emulated card's data phase times out, which does not affect the strategy-path demonstration (bioqdisksort happens before any card I/O). Trigger: physical card removal/hot-unplug mid-I/O or system suspend while I/O continues; no privilege needed to be a producer (any process with the device open). FIX STATUS: compile-validated only - mmcsd is compiled into the stock X86_64_GENERIC kernel (no loadable module to swap on a running system; kldstat shows no mmcsd module), so the runtime A/B could not be performed without a full kernel rebuild. fix.diff (reject-with-ENXIO once a bio is already queued while suspended-and-consumerless) builds clean as a module against KERNBUILDDIR.

## Kernel references
- sys/dev/disk/mmcsd/mmcsd.c:251
- sys/dev/disk/mmcsd/mmcsd.c:312
- sys/dev/disk/mmcsd/mmcsd.c:315

## Evidence
run.log (suspend -> 0; 96 blocked dd's; vmstat b=96 + memory/paging deltas; resume -> 0), mmcrace4784.c (rig + resume action)

## Recommended fix
bound the suspend-queue (reject with ENXIO beyond a limit, or fail fast when running<0 while suspended).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.