# DF-5608 — VERDICT

**Status: reproduced (runtime, one traced boot + one confirmation
boot).** Impact: none (functional/operational regression — no memory
safety, no DoS; SIGTERM/SIGKILL still work). Confidence: certain.

## What was proven

On a real VKERNEL64 boot with an LD_PRELOAD `sigaction()` tracer:

1. The console subsystem installs `vconssignal` for SIGINT early
   (console.c:344-360; traced install `handler=0x72b6d0 flags=0`,
   `nm`: `vconssignal`).
2. At `initclocks` the **vktimer cothread** — a different pthread —
   installs the empty `SA_NODEFER` latch (`handler=0x72aa00
   flags=0x10`, `nm`: `vktimer_sigint`; systimer.c:223-227), which
   being a process-wide `sigaction()` **replaces** `vconssignal`.
   This replacement is REQUIRED by `cothread_wakeup()`'s choice of
   SIGINT as the thread-directed wakeup vector (cothread.c:196):
   SIGINT is not in `cpu_mask_all_signals()`'s set (machintr.c:205),
   so without hijacking the disposition the wakeup SIGINT would run
   whatever handler the process had — in the cothread, with %gs=0
   (see DF-5607 for what a faulting handler does there).
3. Behavioral consequence, live: three `kill -INT`s to the booted
   vkernel child leave it ALIVE — host ^C is dead post-boot
   (`vconssignal` never runs: no terminal restore, no clean
   re-raise). Control: SIGTERM still reaches the console handler path
   ("Caught SIGTERM from host system. Shutting down...").

Root cause is shared between cothread.c (the SIGINT vector choice at
cothread.c:196 — a signal the process ALSO uses for console control)
and systimer.c (the process-wide latch at :227). The console's ^C
feature is silently lost after boot; the operator must use SIGTERM
(wrapper forwards it, init.c:216-219) or SIGKILL.

## Fix direction

The wakeup vector should not be a signal with existing process-wide
meaning. Options: use a dedicated unused signal (e.g. one of the
realtime signals) for `cothread_wakeup()` — blocking it in every
cothread via `cpu_mask_all_signals()` (machintr.c) — or save/restore
the previous SIGINT disposition and chain to `vconssignal` from
`vktimer_sigint` when the signal is process-directed rather than
thread-directed. No fix.diff authored (Low severity, no memory-safety
impact; behavioral evidence only).

## Environment

Same rig as DF-5607 (guest DragonFly 6.5-DEVELOPMENT, VKERNEL64
in-guest build, /vkroot.img, `-n 2`).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)