ARM1 write#1 rc=12
ARM1 write#2 rc=12 (timer cleared pending -> no hang)
ARM1 write#3 rc=12 (pending now set, timer armed)
ARM2 non-owner read rc=-1 errno=1 (EPERM=1)
ARM2: timer should now be DEAD; sleeping past the 0.5s deadline
ARM2 victim pid=1010 write starting
ARM2: SIGKILL victim 1010
RESULT: VICTIM 1010 STILL STUCK AFTER SIGKILL -> unkillable hang REPRODUCED
POC_RC=42
== dmesg tail (expect >=2 'User failed to read buffer in time' from ARM1,
   and NONE after the ARM2 EPERM read = proof the timer was disarmed) ==
cd0 at ata1 bus 0 target 0 lun 0
cd0: <QEMU QEMU DVD-ROM 2.5+> Removable CD-ROM SCSI-0 device 
cd0: 16.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present
Mounting root from hammer2:vbd0s1d
hammer2_mount: root devstr="vbd0s1d"
hammer2_mount: device="vbd0s1d" label="ROOT" rdonly=1
hammer2_ondisk: "/dev/vbd0s1d" zone=2 id=0 offset=0x0000000000000000 size=0x000000063f000000
hammer2_mount: hmp=0xfffff8008fae0000 pmp=0xfffff80090280000
DMA space used: 13580k, remaining available: 131072k
Mounting devfs
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
hangsim: loaded; /dev/hangsim0 is stock tpm20.c
hangsim: transmit(len=12) ok -> pending=12
root0: User failed to read buffer in time
hangsim: transmit(len=12) ok -> pending=12
root0: User failed to read buffer in time
hangsim: transmit(len=12) ok -> pending=12
== stuck victim? ==
(no poc proc)
DONE rc=42