# DF-5623 VERDICT — unbounded FID/VID wait + no convergence check

**Status: not_reproduced (on this guest) — loop-structure analysis certain;
trigger hardware absent. Impact class if triggered: permanent kernel wedge
(DoS) of the affected CPU(s); no memory-corruption primitive.**

## Reproduced?

No. Same hardware gate as DF-5622, live-proven with the same KLD harness
(`pstprobe.c`, see ../DF-5622/run.log): the guest CPU is vendor 0x8086
(Intel), APMI(0x80000007) EDX=0, and `acpi_pst_md_probe()` returns NULL —
the `acpi_pst_amd0f` ops table is never selected, so `amd0f_set_fidvid`
cannot execute on this guest under any configuration reachable from the
standard snapshot (QEMU/KVM does not implement the K8 FID/VID MSR pair
0xc0010041/0xc0010042). The function's entry `rdmsr` (cpufreq_machdep.c:78)
would raise #GP here before reaching any loop — the #GP-on-CPUID-lying-VMM
class is already filed as DF-5484 for the sibling file and is deliberately
not re-filed here.

## Why the finding is solid anyway (trace)

- The two unbounded constructs are macros/loops in the file itself
  (cpufreq_machdep.c:53-56 and 126-142) — no input validation anywhere in
  the file bounds their duration; termination is purely a hardware property
  (pending-bit clear / cfid convergence).
- Execution context makes the wedge system-wide: cpuhelper dispatch onto the
  target CPU (acpi_cpu_pstate.c:1452-1465) + initiator blocked in
  `lwkt_serialize_enter`/cpuhelper reply (acpi_cpu_pstate.c:994-996) — both
  CPUs are lost; the global sysctl / powerd walk every domain.
- The unconditional `return 0` (cpufreq_machdep.c:161) with no
  `cfid/cvid == fv->fid/fv->vid` check desynchronizes state bookkeeping on
  silently-ignored writes (CWE-754).

Threat model honesty: the trigger actor must be root (sysctl, kern_sysctl.c:1446
`SYSCAP_NOSYSCTL_WR` gate) or firmware/powerd acting automatically, and the
*fault condition* belongs to the hardware/VMM. Hence Info (hardening), not a
security-bars DoS. No uid0 chain exists for this class.

## Fix validation

`fix.diff` authored post-verification (never applied to `sys/`):
- `git apply --check` clean against the pristine tree;
- both patched TUs compiled with the guest's kernel toolchain (`cc -Werror
  -D_KERNEL ... -c cpufreq_machdep.c` → .ko relocatable) — see `fixbuild.log`
  (RC=0 for both DF-5622- and DF-5623-patched variants).
Runtime A/B (`fix_status`) is `not_testable`: the baseline hang cannot be
produced on this guest (hardware gate above), so a patched-kernel run has no
baseline to compare against.

## Artifacts

- `pstprobe.c`, `Makefile` — introspection harness (shared with DF-5622)
- `build.log`, `run.log` — harness build + live gate proof (copies)
- `fixbuild.log` — compile validation of BOTH fix.diffs on the guest
- `fix.diff` — bounded spins + ETIMEDOUT + convergence diagnostic
- `env.txt`, `manifest.json`, `verdict.json`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.