{
  "finding_id": "DF-5532",
  "title": "usb_proc_mwait() starvation: wakeup gated on whole-queue-empty, so any continuously refilled usb_process queue holds waiters in uninterruptible sleep long after their own messages completed (root mechanism of the DF-5367..5504 cfg-stall family)",
  "file": "sys/bus/u4b/usb_process.c",
  "verdict": "reproduced",
  "impact": "dos",
  "severity": "Medium",
  "confidence": "certain",
  "reproduce": {
    "build": "cd /root/dfharness && printf 'KMOD=\\tdfharness\\nSRCS=\\tdfharness.c bus_if.h device_if.h\\n\\n.include <bsd.kmod.mk>\\n' > Makefile && : > opt_usb.h && make",
    "run": "kldload ./dfharness.ko; sleep 3; sysctl kern.dfstarv.report; sleep 6; sysctl kern.dfstarv.report; sysctl kern.dfstarv.stop=1; sleep 1; sysctl kern.dfstarv.report; kldunload dfharness",
    "expected": "T+3s/T+9s: victim_ran=1 waiter_done=0 (victim completed ~T+0.5s); after stop: waiter_done=1 starve_ms≈19500 — waiter overslept its messages by ~19.5s under a queue whose every message costs one 10ms tick"
  },
  "kernel_refs": [
    "sys/bus/u4b/usb_process.c:163-167",
    "sys/bus/u4b/usb_process.c:363-394",
    "sys/bus/u4b/usb_process.c:445-447",
    "sys/kern/kern_condvar.c:20-44",
    "sys/bus/u4b/serial/usb_serial.c:655-672",
    "sys/bus/u4b/usb_transfer.c:1286"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "dfharness.c", "Makefile", "build.sh", "run.sh",
    "run.log", "run.2.log", "run.spin.log", "run.patched.log",
    "env.txt", "fix.diff", "verdict.json", "manifest.json"
  ]
}