# DF-5527 — gpio_cherryview: unmap_intr never masks the IRQ line; free-without-teardown leaves an armed orphaned interrupt

## What this pack contains

A production-code harness that runs on the DF-5518 planted-ACPI rig
(stock DragonFly kernel + stock `gpio_intel`/`gpio_acpi` drivers brought
up by planted ACPI tables, fake Cherry-View register image at
0xD0000+0x8000). It demonstrates that
`gpio_cherryview_unmap_intr()` (sys/bus/gpio/gpio_intel/gpio_cherryview.c:380)
never clears the community interrupt MASK bit, so releasing a mapped GPIO
interrupt via `GPIO_FREE_INTR` *without* a preceding `GPIO_TEARDOWN_INTR`
leaves the IRQ line **armed** while its `pin_intr_map` is destroyed —
the exact precondition for an endless interrupt storm
(`gpio_cherryview_intr` takes the `is_level==0` edge-clear path on a
level source that re-asserts immediately).

The harness does an A/B experiment in one `kldload`:

* **A (defect path)**: pin 8 / INTSEL line 5 — `GPIO_ALLOC_INTR` →
  `GPIO_SETUP_INTR` → `GPIO_FREE_INTR` (teardown skipped)
* **B (control)**: pin 15 / INTSEL line 6 — `GPIO_ALLOC_INTR` →
  `GPIO_SETUP_INTR` → `GPIO_TEARDOWN_INTR` → `GPIO_FREE_INTR`

## Build

    sh build.sh     # uploads gpiofree.c + gpio_intel_var.h, builds kmod on guest
                    # (expects the rig to be booted: gpio_intel0 present)

## Run

    sh run.sh       # boots the DF-5518 rig chain, builds + loads the harness,
                    # dumps MASK/IS via the kernel DMAP and /dev/mem

## Expected output (stock kernel — defect present)

    gpiofree[A-setup]: IS=00000020 MASK=00000020 (bit5=1 ...) map5{pin=8,intidx=5,...}
    gpiofree[A-free]:  IS=00000020 MASK=00000020 (bit5=1 ...) map5{pin=-1,intidx=-1,...}
                                ^^^^ LINE STILL ARMED, MAPPING DESTROYED
    gpiofree: SUMMARY ... line5 armed-with-no-mapping=1 (DEFECT if 1), line6 left-armed=0

With `fix.diff` applied (kernel rebuilt), the same run shows:

    gpiofree[A-free]:  IS=00000020 MASK=00000000 (bit5=0 ...) map5{pin=-1,intidx=-1,...}
    gpiofree: SUMMARY ... line5 armed-with-no-mapping=0 ...

`run.log` = stock baseline (full rig boot + harness), `run.fixed.log` =
patched kernel, `fix_build.log` = full untrimmed patched-kernel build.

## Notes

* The QEMU rig cannot inject a real ISA IRQ 5, so the *storm* itself is
  argued from the ISR logic (gpio_cherryview.c:221-235) on top of the
  reproduced armed-line state; see VERDICT.md.
* In-tree caller `gpio_acpi_unmap_aei` (gpio_acpi.c:450-451) always
  teardowns before freeing, so the defect is currently latent — it is a
  provider API-contract hazard (defense in depth), hence severity Info.