{
  "finding_id": "DF-5449",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Mechanism-level reproduction with production machinery (same evidence class as the proven family findings DF-5367/5383/5421/5424/5425): uvscoms cfg callbacks chain sequential synchronous EP0 vendor requests whose errors are discarded (uvscom.c:706-711, 727-732 (ignored)), 4 x 1000 ms + hz/10 per open chain (READ_STATUS uvscom.c:634-641/714-734; set_dtr+set_rts uvscom.c:470-497; set_break uvscom.c:499-512) and 2 x 1000 ms per close chain (HUPCL DTR drop via usb_serial.c:694-696 -> uvscom.c:481; UVSCOM_SHUTDOWN uvscom.c:643-651). Harness on the real usb_process taskqueue: a close(2) (usb_proc_mwait, uninterruptible, usb_serial.c:671-672/955-957) racing an open(2) blocks ELAPSED=5932/5929 ms across two runs (SIGKILL-immune); unplug stalls the hub event thread identically via usb_proc_drain (usb_serial.c:394) plus the per-device enum lock (usb_request.c:467). The tcsetattr chain (2 more writes, uvscom.c:581/614) is currently dead due to the DF-5447 pre_param inversion -- with that fixed it adds ~2.1 s per tcsetattr, user-amplifiable via the double-buffered sc_param_task[2]. Fix mechanism (abort chain on first failed request + 250 ms cfg-path timeout bound) demonstrated at ELAPSED=1285/1277 ms and the fully patched production uvscom.ko compiled -Werror-clean RC=0 on the guest.",
  "exploit_chain": "Evil USB device with a SUNTAC VID:PID from uvscom_devs (uvscom.c:231-242) enumerates as uvscom and never answers vendor control data stages -> every request eats its full 1000 ms timeout -> open(2) cycle = ~4.1 s of sc_tq occupancy; a dialer-group users close(2) right behind it blocks uninterruptibly ~6.1 s; repeated open/close cycles keep the taskqueue and the closer serialized; unplug mid-cycle stalls the per-bus USB hub event thread the same way.",
  "evidence": "run.log/run.2.log: HX5449[A]: closer: unblocked ELAPSED=5932 ms / 5929 ms (baseline) and HX5449[B]: ... ELAPSED=1285 ms / 1277 ms (fix mechanism); task-level traces show cfg-open(READ_STATUS) -> line DTR+RTS -> line BREAK -> HUPCL -> cfg-close; fix_compile.log: patched production uvscom.ko RC=0 -Werror-clean.",
  "kernel_refs": [
    "sys/bus/u4b/serial/uvscom.c:634-641",
    "sys/bus/u4b/serial/uvscom.c:470-512",
    "sys/bus/u4b/serial/uvscom.c:643-651",
    "sys/bus/u4b/serial/uvscom.c:694-734",
    "sys/bus/u4b/serial/usb_serial.c:671-672",
    "sys/bus/u4b/serial/usb_serial.c:777",
    "sys/bus/u4b/serial/usb_serial.c:394",
    "sys/bus/u4b/usb_request.c:642-644"
  ],
  "poc_changes": "No seed PoC existed; authored from scratch on the DF-5421 harness pattern with uvscoms production chain shape (4 open / 2 close requests, 1000 ms). Two bring-up fixes: (1) -Werror distinct-pointer-type on the line-message discrimination -> explicit casts; (2) the closers HUPCL task uses a dedicated message buffer so the unmerged (worst-case, longest) production count is modeled -- noted in VERDICT.md that productions shared double-buffer can merge it down to ~5.1 s.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 480,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys/bus/u4b/serial/hx5449 && make (in-tree kmod build, -Werror clean; see build.sh)",
  "run_cmd": "kldload /root/df5449/uvscomcfgstall.ko; kldunload uvscomcfgstall; dmesg | grep HX5449 (see run.sh)",
  "code_hash": "4b249ec1ad81aa917401125ca44533e5c945d6c0200308398cf2f865a1c08b1c",
  "notes": "Guest cleaned after runs (uvscom.c md5 restored to a58a99ef02d63a2d2e7f7b661f5224b3, harness dirs + scratch removed, no leftover KLDs). Severity Low, consistent with family (DF-5424 ~5.2 s open / DF-5425 ~8.2 s close, both Low): requires an evil/malfunctioning SUNTAC-VID:PID device; block bounded ~6.1 s per cycle. fix.diff (sha256 bd5b90f61e25c9c46d5fff02979ef051770ce1e198865be1f4ad992d208feac6) git-apply --check passes against the host repo tree.",
  "recommended_fix": "Propagate usb_error_t through uvscom_cfg_write, abort the cfg chains on the first failed request, and bound the cfg-path control timeout to 250 ms (full diff in fix.diff).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 1,
  "fix_verdict": "fix.diff (plus the DF-5447/5448 fixes) applied to the guests /usr/src copy: the production uvscom.ko kmod compiled -Werror-clean RC=0 (fix_compile.log); harness phase B models the fixed drivers chain collapse: closer ELAPSED drops from ~5.9 s to ~1.28 s across two runs. The previously-observed multi-second uninterruptible occupancy is GONE under the fix mechanism.",
  "fix_evidence": "fix.diff (sha256 bd5b90f6...); fix_compile.log (RC=0); fix_run.log (HX5449[B]: closer: unblocked ELAPSED=1285/1277 ms); VERDICT.md Fix validation."
}