# DF-5100 VERDICT

**Status: inconclusive (not runtime-exercisable on this guest) — mechanism
proven from source; Info hardening finding, PoC skipped per contract.**

## Reproduced?
No — same environment blocker as DF-5099: joy(4) is module-only and the
guest has no ISA gameport, so `/dev/joy0` does not exist (ENOENT at
`open()`, `run.log`). The trigger builds cleanly on the guest (cc 8.3,
`-Wall`, zero diagnostics).

## Why the defect is real anyway (source proof)
* `joyread()` calls `crit_enter()` (`joy.c:190`) and then busy-loops
  (`joy.c:200-211`) reading the port and calling `nanotime(&t)` until the
  **wall clock** passes `end = start + timeout` (computed at
  `joy.c:193-196`).
* `nanotime()` is realtime — it adds the global `basetime`
  (`sys/kern/kern_clock.c:1562-1587`, `tsp->tv_sec += bt->tv_sec` at
  1581), and `basetime` is exactly what `settimeofday()`/NTP steps change.
* Therefore a backward clock step during the loop moves the sampled `t`
  backward while `end` stays fixed in wall time; `timespeccmp(&t,&end,<)`
  keeps the loop spinning until wall time catches up — holding the CPU in
  a critical section (interrupts masked, preemption and IPIs deferred) for
  up to ~step-magnitude seconds. The loop never re-reads `timeout` and has
  no other deadline.
* Baseline behavior even without a step: every read masks interrupts on
  its CPU for up to 10 ms (`JOY_SETTIMEOUT` max, `joy.c:243`).

## Impact ceiling
Root-gated (`joy.c:133`, node 0600 root): only root can hold the device
open, and root can stall the system by other means. The realistic risk is
a root joystick reader combined with an NTP backward step — a latent local
DoS/latency hazard. Info severity.

## Why no fix validation
Same as DF-5099: the guest kernel never instantiates the device, so
neither baseline nor patched behavior is observable. `fix.diff`
(nanotime → nanouptime at the two call sites; `nanouptime` exists at
`sys/sys/time.h:185`) is correct by construction — the monotonic clock
makes the deadline immune to wall-clock steps — but was not kernel-built.

## Kernel references
- sys/dev/misc/joy/joy.c:190-213 (crit_enter + wall-clock bounded busy loop)
- sys/dev/misc/joy/joy.c:193,195-196,204 (nanotime use / deadline math)
- sys/kern/kern_clock.c:1562-1587 (nanotime = realtime, adds stepped basetime)
- sys/dev/misc/joy/joy.c:243 (timeout capped 1..10000 us)
- sys/sys/time.h:185 (nanouptime — the monotonic fix)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.