{
  "finding_id": "DF-5656",
  "title": "usb_dynamic.c unload hooks guard live dispatch pointers with a 1s tsleep grace period, not synchronization",
  "verdict": "not_reproduced",
  "impact": "none (observed); structural race is code-certain, root-gated",
  "reproduce": {
    "build": "cc -O2 -o quirk_get_spam quirk_get_spam.c   (on the DF guest, against /usr/include/bus/u4b/usb_ioctl.h)",
    "run": "./race_root.sh 20 8   # quirk side (shows usb_quirk built into GENERIC kernel); then the 12x kldload/kldunload usb_template loop for the 1.00s grace-period measurement (see run.log)",
    "expected": "every kldunload usb_template takes exactly 1s (the tsleep grace measured live); kldload usb_quirk refused (built-in); unprivileged GET dispatch works at ~10^5 calls/s; corruption/panic not manifested"
  },
  "kernel_refs": [
    "sys/bus/u4b/usb_dynamic.c:101-114",
    "sys/bus/u4b/usb_dynamic.c:116-130",
    "sys/bus/u4b/usb_dynamic.c:132-144",
    "sys/bus/u4b/usb_dev.c:1710",
    "sys/bus/u4b/usb_device.c:1727",
    "sys/bus/u4b/usb_device.c:2186",
    "sys/bus/u4b/usb_device.c:2614",
    "sys/bus/u4b/usb_request.c:336-341",
    "sys/bus/u4b/quirk/usb_quirk.c:1089-1095",
    "sys/bus/u4b/quirk/usb_quirk.c:735",
    "sys/conf/files:3028",
    "sys/conf/files:3032"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "quirk_get_spam.c", "race_root.sh",
    "build.log", "run.log", "run.2.log", "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}