# DF-5045 — VERDICT

**Verdict:** REPRODUCED (runtime execution of the asymmetric path; Info-grade
hardening finding — no security impact demonstrated)
**Class:** lock lifecycle asymmetry (CWE-667)
**Impact ceiling:** none (defense-in-depth; the defect classes it guards
against — lockuninit on held/recycled locks — are not reachable as shipped)
**Confidence:** certain

## Reproduction

E3 of the DF-5044 harness on the baseline kernel (`run.log`): the stock
kernel's own `sili_os_stop_port()` was called on the exact state the
`sili_port_alloc()` error unwinds produce (`ap_sc` set at sili.c:165,
`ap_thread == NULL`, zeroed locks) and executed `lockuninit(&ap->ap_lock)`
on the never-lockinit'ed lock, returning without panic — benign only
because `M_ZERO` guarantees `lk_count == 0`, which is what satisfies
`lockuninit()`'s KKASSERT (sys/kern/kern_lock.c:1330-1335).  On the
fix-patched kernel the same call also returns 0 (regression check in the
DF-5044 pack's `run.4.log`).

## Mechanism (source-confirmed)

* init: `lockinit(&ap->ap_lock)`, `lockinit(&ap->ap_sim_lock)`,
  `lockinit(&ap->ap_sig_lock)` (sili_dragonfly.c:198-200) +
  `lockinit(&ap->ap_ccb_lock)` (sili.c:170)
* uninit: `lockuninit(&ap->ap_lock)` **only** (sili_dragonfly.c:223) — and
  this also runs on ports whose start_port never executed (the freeport
  error paths with `ap_sc` set).
* `ap_sim_lock` is additionally handed to CAM as the sim lock
  (sili_cam.c) and outlives the sim; none of the three extra locks are ever
  uninited.

## Fix

`fix.diff` (same file as DF-5044's; the lockuninit-symmetry hunks):
`lockuninit(&ap->ap_sim_lock); lockuninit(&ap->ap_sig_lock);` in
`sili_os_stop_port()`, and `lockuninit(&ap->ap_ccb_lock)` in
`sili_port_free()` before `kfree(ap)`.  Validated by the DF-5044 fix kernel
build (`-Werror`, rc=0) and the patched-kernel E3 regression run.

## Gating precondition

None for observing the asymmetry (kld, stock kernel, no hardware); the
guarded-against hazards themselves are not reachable as shipped.

## Exploit chain

Not applicable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.