{
  "finding_id": "DF-5568",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "vktimer_intr_reload()s wakeup CAS loop (systimer.c:301-303) casts the wrap-around delta to unsigned sysclock_t (__uint64_t, systimer.h:51) before comparing < 0, so the while condition is always false and the atomic_swap_long target-lowering protocol never executes. Proven behaviorally on the guest with two instrumented vkernel64 kernels (counters debug.vkt_if / debug.vkt_swap): stock build entered the if-body 42,294 times over boot+drift+2x20s one-shot-timer hogs while the while-body executed exactly 0 times; the otherwise-identical kernel with the single (sysclock_t)->(ssysclock_t) cast fix executed the while-body 32,722 times (~1:1 with if-entries), with identical timer behavior (DRIFT10MS ratio 1.000 both builds, hogs complete, vkernel alive, no panic). The defect is real dead code that disables the intended cothread-wakeup target-lowering and causes redundant cothread_wakeup/pthread_kill(SIGINT) churn under dense one-shot timer load, but timer delivery itself never broke (no hang, no missed-wakeup in evidence), and there is no memory-safety, privilege, or info-leak consequence; severity Low.",
  "exploit_chain": "",
  "evidence": "run.instr.log / run.fixed.log: counter tables debug.vkt_if: 16042->42294, debug.vkt_swap: 0->0 (stock) vs debug.vkt_if: 12411->32540, debug.vkt_swap: 12515->32722 (fixed); DRIFT10MS ratio 1.000 on both; HOGS_RC=0 and ALIVE_AT_END on both. VERDICT.md has the full A/B narrative and the negative-results appendix (boot-order, teardown, arithmetic bounds).",
  "kernel_refs": [
    "sys/platform/vkernel64/platform/systimer.c:301",
    "sys/platform/vkernel64/platform/systimer.c:302",
    "sys/platform/vkernel64/platform/systimer.c:303",
    "sys/platform/vkernel64/platform/systimer.c:263",
    "sys/platform/vkernel64/platform/systimer.c:275",
    "sys/sys/systimer.h:51",
    "sys/platform/vkernel64/platform/cothread.c:192"
  ],
  "poc_changes": "Rig repaired vs DF-5556 seed: created /var/vkernel and set vm.vkernel_enable=1 on the fresh snapshot; output-only completion marker (TERMINUS: 42) because the echoed fifo input previously matched the VKDONE grep and killed the run early; split verification diffs into instr.diff (counters) and instrfix.diff (counters + cast fix) because fix.diff (vs pristine) cannot apply on top of instr.diff by construction; added drift.c PASS/FAIL calibrated to coarse mode (10ms exact / 1ms clamp documented at systimer.c:275-282 with use_precise_timer=0).",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 2100,
  "guest_dirty": 0,
  "build_cmd": "sh /root/build.sh  (cc -static drift.c/hog.c; vnconfig+newfs /vkroot2.img; make -j6 nativekernel KERNCONF=VKERNEL64 twice: kernel.instr, kernel.fixed)",
  "run_cmd": "sh /root/run.sh /root/kernel.instr instr ; sh /root/run.sh /root/kernel.fixed fixed   (vkernel -m 512m -r /vkroot2.img -n 2)",
  "code_hash": "b50185485b77f04cf1d9d033d3f0a0957e5d33efa3f2454ee9cc0e1020911e04",
  "notes": "DRIFT1MS ratio 10.000 appears on BOTH builds: documented coarse-sleep clamp (systimer.c:275-282, use_precise_timer=0 default per init.c:126, -t boot flag enables precise mode) - pre-existing designed behavior, not part of this finding, unchanged by the fix. Impact enum none reflects that no security consequence (memory safety, privesc, leak, DoS) could be demonstrated; the measurable effect is redundant signal churn and loss of an intended race-mitigation.",
  "recommended_fix": "In vktimer_intr_reload(), change the while loops cast from (sysclock_t) to (ssysclock_t) so the atomic_swap_long target-lowering loop actually executes.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": true,
  "fix_verdict": "Applied fix.diff (one-cast change) to the guest /usr/src copy, rebuilt the VKERNEL64 kernel, and re-ran the identical workload: baseline kernel shows vkt_swap 0->0 (dead CAS, 42,294 if-entries); patched kernel shows vkt_swap 12515->32722 (protocol live). Timer function is unchanged (DRIFT10MS 1.000 on both, HOGS_RC=0, ALIVE_AT_END, no panic, no watchdog), so the fix restores the intended protocol with no regression.",
  "fix_evidence": "fix.diff; instrfix.diff (verification build); run.instr.log vs run.fixed.log counter tables; build.fixed.log; vkcon.fixed.log",
  "fix_kernel_uname": "DragonFly 6.5-DEVELOPMENT #0: Wed Oct  7 20:38:58 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/VKERNEL64 (kernel.fixed, vkernel64 in-guest)"
}