{
  "finding_id": "DF-5661",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "The vkernels only host-SIGTERM shutdown path, shutdown_intrs ksignal(initproc, SIGUSR2) (shutdown.c:95), is a silent no-op whenever pid 1 does not catch SIGUSR2: kern_sigs issignal loop drops default-action signals to pid<=1 (kern_sig.c:2134-2144) and execsigs() only resets caught signals, so the whole boot window (create_init .. init(8) arming handlers) -- and permanently for a vkernel whose init_path is not real init(8) -- swallows the documented stop signal after printing Shutting down.... Rig-proven live: kill -TERM mid-boot and post-boot left the vkernel alive indefinitely (verified by executing console commands inside the shut-down guest: GUEST_ALIVE_OK; and kill -USR2 1 from inside the guest: STILL_HERE_AFTER_USR2); a burst of SIGTERMs during boot produced a stream of Shutting down... lines while boot continued normally. With fix.diff (shared with DF-5660) and a handler-less pid 1 standing in for pre-arm init(8), the same kill -TERM now takes the in-kernel path and halts cleanly: boot() called on cpu#0 ... The operating system has halted. ... cpu halt, exiting vkernel, monitor exits, guest host untouched.",
  "exploit_chain": "same-uid signal (operator stop script / host shutdown sweep) during vkernel boot -> shutdown_intr prints Shutting down... -> ksignal(initproc, SIGUSR2) dropped by the pid<=1 SIG_DFL guard -> vkernel never stops -> host powers off underneath the running vkernel -> unclean guest disk images, stale locked pidfile",
  "evidence": "run.midboot.noop.log + wedge_probe.log (message then live guest: GUEST_ALIVE_OK, STILL_HERE_AFTER_USR2); bootlog_excerpt.txt (no-op at scale); run.fixboot.log (clean kernel-side halt on the patched kernel); VERDICT.md",
  "kernel_refs": [
    "sys/platform/vkernel64/platform/shutdown.c:95",
    "sys/kern/kern_sig.c:2134",
    "sys/kern/kern_sig.c:426",
    "sys/kern/init_main.c:716",
    "sbin/init/init.c:1343"
  ],
  "poc_changes": "run.sh adapted from the DF-5607 rig driver; added vkinit3 (pid-1 with no handlers) to /vkroot.img for fix validation; probes injected through the fifo console to prove guest liveness post-SIGTERM.",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 900,
  "guest_dirty": 1,
  "build_cmd": "sh build_image.sh   (rig: make -j6 nativekernel KERNCONF=VKERNEL64; vkinit3 added for fix validation)",
  "run_cmd": "sh /root/run5661.sh midboot ; sh /root/run5661.sh fullboot",
  "code_hash": "34f2a2c937955bbd542524d1713720538c86461699337f7ee4627eea33ff8e4d",
  "notes": "Same function as DF-5660; shared fix.diff. The delivery-latency observation (all shutdown_intr executions land post-create_init under external signaling) is recorded in DF-5660/VERDICT.md and bounds both findings boot-window reachability from outside.",
  "recommended_fix": "Only ksignal init when init actually catches SIGUSR2 (ps_sigcatch gate) and otherwise take the in-kernel shutdown path (shutdown_nice(RB_POWEROFF|RB_HALT) with the kern_shutdown.c hardening hunks); see fix.diff.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "Baseline: kill -TERM (mid-boot and full-boot, handler-less pid 1) -> Caught SIGTERM ... Shutting down... then the vkernel stays alive forever (live-guest probes). Patched: identical trigger -> complete clean halt (boot() on cpu#0, system threads stopped, The operating system has halted., cpu halt, exit(EX_OK), monitor exits); FIXB RESULT: exited.",
  "fix_evidence": "run.fixboot.log (full halt transcript); bootlog_excerpt.txt (serial console: FIXB RESULT: exited)"
}