{
  "finding_id": "DF-5608",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "cothread_wakeup() pthread_kills SIGINT into cothreads (cothread.c:196); to make that survivable the vktimer cothread installs an empty SA_NODEFER SIGINT handler process-wide (systimer.c:223-227), which permanently REPLACES the vkernel consoles SIGINT handler vconssignal (console.c:355, installed earlier at console init). Traced live on a real VKERNEL64 boot: install sequence SIG_IGN(init.c:209) -> vconssignal(console.c:355) -> vktimer_sigint(systimer.c:227, from the cothread pthread, flags=SA_NODEFER); after boot, 3x kill -INT to the vkernel child leaves it alive (host ^C dead -- no terminal restore, no clean termination), while SIGTERM still shuts it down. Operational regression owned by the SIGINT vector choice; no memory-safety impact.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5608/run.driver.log (SIGTRACE install sequence with nm-confirmed symbol addresses 0x72b6d0=vconssignal / 0x72aa00=vktimer_sigint; AFTER_SIGINT_3 STILL ALIVE; SIGTERM shutdown in console tail); run.log (full traced console)",
  "kernel_refs": [
    "sys/platform/vkernel64/platform/cothread.c:196",
    "sys/platform/vkernel64/platform/systimer.c:227",
    "sys/platform/vkernel64/platform/console.c:355",
    "sys/platform/vkernel64/platform/init.c:209",
    "sys/platform/vkernel64/platform/machintr.c:205"
  ],
  "poc_changes": "Authored from scratch (no seed): LD_PRELOAD sigaction tracer + child-vs-wrapper targeting (the init.c fork wrapper SIG_IGNs SIGINT itself, so the behavioral test must target the vkernel child pid).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 400,
  "guest_dirty": 0,
  "build_cmd": "cc -shared -O2 -fPIC -o /root/sigtrace.so sigtrace.c",
  "run_cmd": "sh /root/run5608.sh",
  "code_hash": "6497dab05e1f7401f1357a0298261a49beb90c9a75ef59c7aa8f10916af23b51",
  "notes": "Low severity / operational. The latch hijack also means any OTHER process-directed SIGINT consumer would break the same way. Cross-ref DF-5607 (what an unsafe SIGINT handler in a %gs=0 cothread would do).",
  "recommended_fix": "Move the cothread wakeup vector off SIGINT (dedicated signal, blocked in cothreads via cpu_mask_all_signals) or chain to the previous disposition from vktimer_sigint.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "No fix build for a Low/operational finding (contract skips Low hardening); behavioral fix direction documented in VERDICT.md.",
  "fix_evidence": ""
}