# DF-5638 VERDICT — REPRODUCED

**Root cause:** `smbus_poll()` (sys/bus/smbus/smbconf.c:82-102) sleeps
`tsleep(sc, 0, "smbreq", 0)` for `SMB_WAIT|SMB_NOINTR` (smbconf.c:92-94).
`SMB_NOINTR` is 0 (smbconf.h:42), so every caller passing plain
`SMB_WAIT` — in-tree: ipmi_ssif.c:81 and :181, cyapa.c:1176 and :1624 —
parks with **no PCATCH and no timeout**. If the smbus is held (by another
child, by a wedged owner — see DF-5637's permanent wedge — or via the
check-then-sleep lost-wakeup window in smbconf.c:120-124 where a release's
wakeup fires between the failed callback and the tsleep), the calling
thread sleeps indefinitely and cannot be killed.

**Reproduced (stock kernel, DF-5636 rig):** `./df5636ctl park` holds the
bus with devA and calls `smbus_request_bus(smbus, devB, SMB_WAIT=0x1)` from
a *user process*: `ps` shows the process in state `D4` on wchan `smbreq`;
`kill -9` has no effect; the SIGKILL is delivered only after
`./df5636ctl unpark` releases the bus (and the wake path additionally
hands the parker the DF-5636 phantom grant, `<<< phantom grant on wake`).

**Fixed kernel (fix.diff, kernel #3):** `smbus_poll` always sleeps with
PCATCH and an hz bound (mirroring the DF-5564 iiconf fix). The parker now
shows `S2 smbreq` and `kill -9` kills it immediately — verified in the
same session (`kill -9 WORKED: parker died`). The hz bound also converts
the lost-wakeup strand into a 1-second self-healing retry.

**Residual (documented, not in this fix):** no detach drain — kldunload of
the smbus/iicsmb modules under a *now bounded* waiter is still not
explicitly serialized; with PCATCH+hz the waiter is killable and re-checks
within a second, which defuses the DF-5563-class freed-text resume
practically, but a proper drain flag (cf. the DF-5563 fix's
dying/waiters/spinlock) belongs to a family-wide rework of both iiconf and
smbconf.

**Classification:** status=reproduced, reproduced=1, impact=dos, confidence
certain. Severity Low (DF-5563/5564 twin band): unkillable-state local DoS
reachable from root-only device entry points or kernel threads.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.