{
 "finding_id": "DF-4784",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "denial_of_service",
 "confidence": "certain",
 "verdict": "Mechanism reproduced on real emulated hardware (QEMU sdhci-pci + sd-card; mmcsd0 256MB attaches natively). Using the DF-4783 rig (mmcrace.ko, extended with a resume action) to invoke the REAL mmcsd_suspend() method: after 'mmcrace: suspend -> 0' (suspend=1, worker killed, running==-1), mmcsd_strategy (:312-315) kept enqueueing every bio into sc->bio_queue with no consumer, no bound and no ENXIO: 96 concurrent dd readers (4MB each) were all accepted and left permanently blocked (vmstat 'b' column = 96; ~400MB+ of buffers/pages pinned; paging activity began) - the queue accepted everything thrown at it. device_resume (mmcsd_resume restarts the worker and suspend=0) proves the bios were queued rather than rejected. Ceiling is kernel-memory exhaustion under sustained load - already witnessed live during the DF-4783 session as 'panic: malloc limit exceeded' with a consumerless queue; on this rig the emulated card's data phase times out, which does not affect the strategy-path demonstration (bioqdisksort happens before any card I/O). Trigger: physical card removal/hot-unplug mid-I/O or system suspend while I/O continues; no privilege needed to be a producer (any process with the device open). FIX STATUS: compile-validated only - mmcsd is compiled into the stock X86_64_GENERIC kernel (no loadable module to swap on a running system; kldstat shows no mmcsd module), so the runtime A/B could not be performed without a full kernel rebuild. fix.diff (reject-with-ENXIO once a bio is already queued while suspended-and-consumerless) builds clean as a module against KERNBUILDDIR.",
 "evidence": "run.log (suspend -> 0; 96 blocked dd's; vmstat b=96 + memory/paging deltas; resume -> 0), mmcrace4784.c (rig + resume action)",
 "kernel_refs": [
  "sys/dev/disk/mmcsd/mmcsd.c:251",
  "sys/dev/disk/mmcsd/mmcsd.c:312",
  "sys/dev/disk/mmcsd/mmcsd.c:315"
 ],
 "poc_changes": "mmcrace.c from DF-4783 pack extended with action=14 (device_resume method-table invocation); build via bsd.kmod.mk with KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 600,
 "guest_dirty": 0,
 "build_cmd": "cd /root/mmcrig && make SYSDIR=/usr/src/sys KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC",
 "run_cmd": "kldload mmcrace.ko; sysctl hw.mmcrace.action=13; launch 96 dd readers; vmstat",
 "code_hash": "0ce195e7ebcbcfa65313109a71153503680bc222d6e10ca8b2c6d6def07ebd9a",
 "notes": "emulated card data phase times out on this QEMU build (reads return 0 bytes even pre-suspend); irrelevant to the queueing mechanism. Sibling DF-2480 rig reused.",
 "recommended_fix": "bound the suspend-queue (reject with ENXIO beyond a limit, or fail fast when running<0 while suspended)."
}