# DF-5653 — VERDICT

**Finding:** `elcr_write_trigger()` performs an unlocked
read-modify-write of the global `elcr_status` shadow and the paired
port byte — `sys/platform/pc64/icu/elcr.c:103-117` — and the caller
`icu_abi_legacy_intr_config()` (icu_abi.c:366-397) serializes nothing
(it does not even take `icu_irqmap_tok`, which the MSI paths in the
same file hold; cf. icu_abi.c:463, 529, 625).

**Verdict: REPRODUCED (live, measured): 1,827 + 2,158 lost
trigger-mode updates out of 300,000 writes per thread in a 2-second
run. Severity Low (root/boot-gated reach; real functional consequence
on hit).**

## Mechanism

```
CPU0 (irq5 -> LEVEL)                CPU1 (irq7 -> LEVEL)
new = elcr_status | 0x20   (stale base S0)
                                    new = elcr_status | 0x80  (same stale S0)
elcr_status = new          (S0|0x20)
                                    elcr_status = new         (S0|0x80 — bit5 LOST)
outb(0x4d0, shadow&0xff)           outb(0x4d0, shadow&0xff)   (bit5 lost in HW too)
```

Both the shadow and the hardware byte converge to the loser's word: the
winner's `LEVEL` request for irq5 is silently reverted to `EDGE`. On
real hardware a level-triggered device (e.g. an ISA/EISA card or ACPI
SCI configured level) whose request is dropped runs edge — interrupt
storms or lost interrupts for that line.

## Live proof (run.log phase R, X86_64_GENERIC, 6 vCPU)

Two kernel threads pinned to cpu0/cpu1 (`kthread_create_cpu`),
300,000 iterations each, each iteration = one real
`elcr_write_trigger()` + a shadow read-back check on the same
interrupt-mode it just wrote:

```
R1: done=2 waited=2s lost_irq5=1827 lost_irq7=2158
```

≈0.6% of all writes were clobbered by the peer's stale-word store —
the race is not theoretical; it hits thousands of times per second of
contention. After the run both irqs were restored to their baseline
EDGE modes and the ELCR verified back at 0x0c00 (`R2 ... ok=YES`,
`E9 ... coherent=YES guest HEALTHY`).

## Reachability (why Low, not higher)

* No in-tree path lets two CPUs call `legacy_intr_config` concurrently
  today: PCI probing is serialized at boot, `acpi_sci_config()` runs on
  cpu0 only (`KKASSERT(mycpuid == 0)`, acpi_fadt.c:222), and the
  post-boot route (kldload of a driver calling `bus_config_intr`) is
  root-only. The unprivileged-user reach is nil.
* The 0x4d0/0x4d1 byte writes do not interleave with the ICU mask
  writes at 0x21/0xa1 (different registers), so there is no mask vs
  trigger register-tearing hazard — the defect is purely the
  shadow-word RMW, plus the same-thread variant (interrupt handler
  calling `elcr_write_trigger` between elcr.c:113 and elcr.c:115-117),
  which converges and is benign.
* Root-gated with a concrete, measured corruption primitive of a
  hardware config register: Low per the rubric ("requires
  already-privileged user"), certain mechanism.

## Fix

Serialize the shadow update + port write with a spinlock (fix.diff) —
DragonFly idiom `static struct spinlock x = SPINLOCK_INITIALIZER(...)`
(cf. subr_prf.c:107). The early-out (`new_status == elcr_status`) is
moved inside the lock so the check can't race either. `elcr_resume()`
may take the same lock for symmetry when it gains callers (DF-5654).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.