# DF-5672 — pc64 twin of DF-5671: stale "locked or" comment vs nonlocked emission in ipl_funcs.c

## What to look at

`sys/platform/pc64/x86_64/ipl_funcs.c:37-43` (comment) vs `:49` (emission), twin of
DF-5671 (`sys/platform/vkernel64/platform/ipl_funcs.c:42/49`).

The comment block asserts, for `gd_spending`:

1. "spending may be manipulated by interrupts **or other cpu's** without holding
   any locks" (ipl_funcs.c:38-40) — FALSE on pc64: exhaustive writer grep shows
   the only RMWers of any CPU's `gd_spending` are (a) the `DO_SETBITS` functions
   themselves, which resolve `gd = mdcpu` — always the *calling* CPU's private
   struct (ipl_funcs.c:48-49) — and (b) the same-CPU `btrl` clears in
   `ipl.s:275` / `ipl.s:431` (`doreti_soft`/`splz_soft`, via `PCPU(spending)`).
   No foreign-CPU writer exists anywhere in `sys/`.
2. "setbits uses a **locked or**, making simple cases MP safe" (ipl_funcs.c:42)
   — FALSE: `:49` emits `atomic_set_int_nonlocked` = an **unlocked** `orl`
   (`sys/cpu/x86_64/include/atomic.h:110-115`, instantiated at `:128`), which
   the header itself documents as only "local-interrupt-safe", *not* MP-safe
   (`atomic.h:72-74`).

## Reproduce (live guest)

```sh
./run.sh            # disassembles the DO_SETBITS functions in the RUNNING kernel
                    # + splz critcount self-guard + live softint/IPI counters
```

Expected (see run.log): every generated pend function shows

```
orl    $<bit>,0x42cc(%rax)        # gd_spending  — NO lock prefix
lock orl $0x2,0x18(%rax)          # gd_reqflags RQF_INTPEND — locked
```

i.e. the spending store is unlocked (contradicting the comment) while only the
reqflags store is locked. The locked/unlocked split is *deliberate and correct*
under the unstated per-CPU invariant — the defect is the misleading comment,
which invites a future cross-CPU accessor of `gd_spending` believing the locked-OR
claim, which would produce silent lost-update pend drops (missed softints →
system hangs).

## Verdict

Status **reproduced** (comment↔code divergence demonstrated on the live guest
kernel), impact **none** (documentation defect; no runtime manifestation — the
unlocked OR is safe because the per-CPU invariant holds by construction).
Severity: Info, confidence certain.

See VERDICT.md for the full narrative including the negative results on the
spl0/splx gates, the unpend-loop bit math, and the cross-CPU caller sweep.