# DF-5628 — ppb_poll_bus() sleep arithmetic `hz/100`: with the boot tunable `kern.hz < 100` the poll's tsleep gets timo=0 and arms NO timeout (permanent unkillable park)

File: `sys/bus/ppbus/ppb_base.c:77,83`; tick source `sys/kern/subr_param.c:54,199`
(`HZ_DEFAULT 100`, `TUNABLE_INT_FETCH("kern.hz", &hz)`); sink
`sys/kern/kern_synch.c:691` (`if (timo)` — timo==0 arms no callout).

## Build (inside the DragonFly guest)

```
sh build.sh     # compiles VERBATIM /usr/src/sys/bus/ppbus/ppb_base.c into ppbbasehx.ko
```

## Run (inside the guest)

```
sh run.sh
```

## Expected (decisive lines, see run.log)

```
PPBHX: DF-5628 hz=100 -> hz/100=1 tick(s) per poll sleep; ...
PPBHX: DF-5628 after 6 ticks: park thread wchan==ident:1 wmesg=ppbhz0 -> STILL ASLEEP: ...
PPBHX: DF-5628b hz forced to 50 ...: production ppb_poll_bus(max=3, PPB_NOINTR) on park thread ...
PPBHX: DF-5628b after ~300ms ...: hz-park thread wchan==bus:1 wmesg=ppbpoll -> STILL PARKED IN PRODUCTION ppb_poll_bus: the 30ms timeout never fired (50/100==0 -> timo==0 -> no callout)
PPBHX: DF-5628b hz=50 production ppb_poll_bus returned 0 only after wakeup+match ...
```

Two chained demonstrations against production code:

1. **tsleep semantics** — a thread on `tsleep(..., "ppbhz0", 0)` is still
   asleep (`wchan==ident`, `wmesg=ppbhz0`) many ticks later and wakes only
   on the explicit `wakeup()`; `kern_synch.c:691` arms a timeout only
   `if (timo)`.
2. **production park at hz=50** — the harness briefly sets `hz=50` (the
   documented `kern.hz` tunable value space) and runs the *production*
   `ppb_poll_bus(max=3, PPB_NOINTR)` on a worker thread against a
   never-matching peer: after the busy prologue the thread sits parked on
   `wchan==bus, wmesg=ppbpoll` with no timeout ever firing (a working
   3x10ms timeout would have returned EWOULDBLOCK within ~60ms), and
   returns only when the harness makes the condition match and issues an
   explicit `wakeup(bus)`.

In-tree callers: the only sleeping-poll caller without PPB_POLL is
`byte_peripheral_write()` (ppb_1284.c:410, `PPB_INTR` + PCATCH) — signals
still rescue it, but its 10 ms poll cadence silently degrades to
"wake-only-on-signal-or-success"; a `PPB_NOINTR` + non-POLL caller (none
in-tree today; the flag combination is the documented API,
ppbconf.h:123-126) parks forever, unkillable.  Info severity (requires
the unusual-but-supported `kern.hz<100` boot configuration).

## Harness note

One shared KLD harness demonstrates DF-5625/5626/5627/5628; this pack's
lines are the `DF-5628`/`DF-5628b` ones.  `hz` is restored to 100 at the
end of the test.