{"finding_id":"DF-4859","status":"untested","attempts":0,"reproduced":0,"impact":"dos","confidence":"certain","verdict":"Hardware-gated (no TPM ACPI device on guest): all nine error exits in tpmtis_transmit return without relinquishing locality 0 (only the success path relinquishes; the interrupt clear lives in relinquish) - the TIS twin of DF-1990. Amplifier: the interrupt path of request_locality has no pre-sleep ACCESS check, so a re-request for an already-owned locality never gets a LOC_CHANGE interrupt and EVERY subsequent transmit sleeps the full 750ms uninterruptibly - permanent ~1s-per-transaction degradation after the first error, cumulative stall for root and the shutdown path. Root/wheel 0600 cdev or hostile TPM. Wrapper-always-relinquish + pre-check fix.","exploit_chain":"failed transmit (stalled TPM) -> locality stays claimed + interrupts uncleared -> every later /dev/tpm0 write pays 750ms uninterruptible sleep -> shutdown state-save stalls","evidence":"findings/poc/DF-4859/ (this verdict)","kernel_refs":["sys/dev/crypto/tpm/tpm_tis.c:407","sys/dev/crypto/tpm/tpm_tis.c:412-486","sys/dev/crypto/tpm/tpm_tis.c:351-353"],"guest_uname":"","code_hash":""}