# DF-5496 — umct(4) cfg-chain synchronous-EP0 stall (ucom family)

**File:** `sys/bus/u4b/serial/umct.c` (Magic Control Technology USB-RS232,
Belkin F5U109/F5U409, Sitecom; ucom core)
**Class:** cfg-stall family (cf. DF-5476 ubsa / DF-5421 uchcom / DF-5424
uftdi / DF-5425 uslcom / DF-5449 uvscom / DF-5456 umoscom / DF-5487 uvisor)
**Evidence class:** KLD-harness-with-production-code (no MCT USB device
model exists on the QEMU guest; the harness drives the real in-kernel
`usb_process` taskqueue machinery that ucom's cfg callbacks, synchronous
close and detach drain run on, with umct's exact production request
counts and the production 1000 ms timeout).

## Build (on the guest)

```
sh build.sh     # cd /usr/src/sys/bus/u4b/serial/um5496 && make
                # artifact: umct5496stall.ko  (-Werror clean)
```

## Run (on the guest)

```
sh run.sh       # dmesg -c; kldload /root/df5496/umct5496stall.ko (~23 s,
                # all phases at MOD_LOAD); kldunload; dmesg | grep UM5496
```

## Expected decisive output (measured 2026-10-06)

```
UM5496[A]: closer: unblocked  ELAPSED=3885 ms   (first open: 3-req
            line-state task + 1-req HUPCL DTR drop; first-open param
            bails !LL_READY)
UM5496[2]: closer: unblocked  ELAPSED=5952 ms   (+ 1 tcsetattr: 2 reqs
            + hz/10 pause)
UM5496[3]: closer: unblocked  ELAPSED=8049 ms   (+ burst of 5 tcsetattr
            coalesced to 2 param executions — production msignal
            double-buffer ceiling; a paced/sustained loop extends
            without bound until the abuser stops)
UM5496[B]: closer: unblocked  ELAPSED=3033 ms   (fix#1: abort on error)
UM5496[C]: closer: unblocked  ELAPSED=834 ms    (fix#1+#2: abort+250 ms)
```

Every simulated request sleeps its full ~980–1000 ms (absolute
timestamps in run.log), i.e. each is the real in-kernel cost of an
unanswered EP0 data/status stage.

## Fix validation

`fix.diff` (8 hunks): error-returning `umct_cfg_do_request()`, chain
aborts in `umct_cfg_set_{break,dtr,rts}`/`umct_cfg_param`, cfg-path
timeout bounded 1000 → 250 ms (`UMCT_CFG_TIMEOUT`). Applies 8/8 clean
(`git apply --check` + guest `patch -p1`) and the patched production
`umct.ko` compiles with zero compiler diagnostics (`fix_compile.log`;
the only "error" string in the log is the literal `-Werror` flag).

## Artifacts

- `um5496stall_harness.c` — the rig (self-contained KLD)
- `Makefile`, `build.sh`, `run.sh` — exact build/run
- `build.log` / `run.log` / `fix_compile.log` — full untrimmed logs
- `env.txt` — guest uname/compiler
- `fix.diff` — git-apply-able unified diff (never applied to `sys/`)
- `VERDICT.md` — full narrative; `manifest.json` + `verdict.json`