{
  "finding_id": "DF-5513",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "REPRODUCED 4/4 pristine runs. ppb_request_bus() tests only is ANY owner present (ppbconf.c:466); a device that already owns the bus and re-requests falls into the same sleep as any other waiter -- for PPB_WAIT|PPB_NOINTR that is tsleep(ppb, 0, \"ppbreq\", 0) with no PCATCH and no timeout (:473-475), i.e. the owner waits for itself forever. Rig: an owning child re-requests on a kernel thread and is still asleep after 3 s in every run; only an explicit ppb_release_bus() from another thread revives it. Production trigger: pcfclock_open() (pcfclock.c:152-153) has no HAVEBUS-style guard and passes bare PPB_WAIT, so a second open of the world-readable (0444) /dev/pcfclock0 hangs the opener unkillably (kill -9 impossible) -- the unprivileged end-user path was fully verified on real hardware by sibling finding DF-5029 against pcfclock.c; the present finding pins the ppbus-side semantics (any driver that re-requests while owning) and the bus-level fix. Fix validated: with an owner==dev early-out the re-request returns 0 immediately.",
  "exploit_chain": "",
  "evidence": "run.log (DF-5513 REPRODUCED: owner re-requested ... STILL ASLEEP after 3s ... only ppb_release_bus() ever wakes it); fix_run.log (not-reproduced: request returned spontaneously ret=0); harness.c hx_f4_selfreq_test/hx_f4_sleeper; fix.diff hunk 3.",
  "kernel_refs": [
    "sys/bus/ppbus/ppbconf.c:464",
    "sys/bus/ppbus/ppbconf.c:466",
    "sys/bus/ppbus/ppbconf.c:473",
    "sys/dev/misc/pcfclock/pcfclock.c:152"
  ],
  "poc_changes": "No seed PoC existed (pass-2 finding); rig written from scratch following the DF-5418/5419 ppbharness class: verbatim-source KLD (ppbconf.c+ppb_1284.c+ppb_base.c), scripted IEEE1284 nibble-mode peer, fake ppc controller on nexus, real ppbus driver attach. Bring-up fixes: comment typo; the stack pre-dirtier initially collapsed to a single frame via -O2 tail-call optimization (made noinline with a post-call touch).",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 75,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh  (guest: cp harness.c Makefile /tmp/ppx2; make SYSDIR=/usr/src/sys)",
  "run_cmd": "kldload /tmp/ppx2/ppbharness2.ko; sleep 75; dmesg | grep PPBX2   (sh run.sh)",
  "code_hash": "eaa32f734c11c69696b7b680eca63a67cc24686475391b9b09cbd0c55c6be222",
  "notes": "Complements DF-2329 (lost-wakeup race) and DF-5029 (pcfclocks bare PPB_WAIT): here NO wakeup can ever arrive because the sleeper IS the owner. lpt/ppi guard re-requests with their own HAVEBUS/HAVE_PPBUS flags; pcfclock does not.",
  "recommended_fix": "Early-out for the current owner inside the crit section: if (ppb->ppb_owner == dev) { crit_exit(); return (0); } (fix.diff hunk 3).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied to the guests /usr/src/sys/bus/ppbus/ppbconf.c, harness rebuilt from the same verbatim source (module-level rebuild; running kernel unchanged), full rig re-run on a fresh boot: the previously observed bad behavior is GONE (the owner re-request returns 0 immediately (done=1, no sleep), verified on two patched boots). Behavior of the sibling known findings (DF-1093/2327/2328/2329) was not targeted by this diff.",
  "fix_evidence": "fix_run.log / fixrun2.dmesg (patched) vs run.log / run4.dmesg (pristine) in this pack; fix.diff is the exact applied diff.",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64"
}