{
  "finding_id": "DF-5533",
  "title": "usb_proc_drain() cold-path: suspend_kproc() on a thread that can never acknowledge (suspend check #if 0'd out, macro calls nonexistent kthread_suspend_check) — drain sleeps forever in suspkp holding the USB bus lock",
  "file": "sys/bus/u4b/usb_process.c",
  "verdict": "reproduced",
  "impact": "dos",
  "severity": "Low",
  "confidence": "certain",
  "reproduce": {
    "build": "cd /root/dfharness && printf 'KMOD=\\tdfharness\\nSRCS=\\tdfharness.c bus_if.h device_if.h\\n\\n.include <bsd.kmod.mk>\\n' > Makefile && : > opt_usb.h && make",
    "run": "kldload ./dfharness.ko; sleep 1; sysctl kern.dfstarv.stop=1; sleep 2; nohup sh -c 'sysctl kern.dfcold.fire=1; echo rc=$?' > /root/fire.log 2>&1 & sleep 3; cat /root/fire.log; ps -axH -o pid,stat,wchan,comm | grep -E 'dfhz|sysctl'",
    "expected": "sysctl thread in D1 state on wchan suspkp forever; fire.log empty (no return; usb_process.c:437 WARNING never prints); dfhz thread B-state blocked on the bus lock the wedged drain holds"
  },
  "kernel_refs": [
    "sys/bus/u4b/usb_process.c:86-89",
    "sys/bus/u4b/usb_process.c:60",
    "sys/bus/u4b/usb_process.c:433-439",
    "sys/kern/kern_kthread.c:188-204",
    "sys/bus/u4b/controller/usb_controller.c:210-236"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "dfharness.c", "Makefile", "build.sh", "run.sh",
    "run.log", "run.patched.log", "env.txt", "fix.diff", "verdict.json", "manifest.json"
  ]
}