# DF-5693 — prop_bool.c shares the kernel cmpset-once with no completion barrier

**File:** `sys/libprop/prop_bool.c` (pass 2, GLM 5.3)
**Class:** lazy-init race (same macro family as DF-2225 prop_dictionary, DF-5681 prop_number)
**Severity: Low · Confidence: likely (mechanism certain in rig; kernel window one-shot per boot)**

## Build (on the DragonFly guest, as root, in /tmp)

```
sh /tmp/build.sh     # builds prop5693_orig (stock, CONTROL) and
                     # prop5693_ksem (userland once swapped for a faithful
                     # port of the _KERNEL cmpset-once + env-controlled
                     # window widening), links race_bool / race_bool_ksem
```

## Run

```
sh /tmp/run.sh       # full 6-section battery (~3 min)
```

## Expected

| Section | Variant | Expected | Observed (run.log) |
|---|---|---|---|
| 1 control ×5 | stock (pthread_once) | survive | 5/5 exit=0 |
| 2 state A ×5 | ksem, `PROP_WIDEN_MS=50` | `VIOLATION[A:po_type=NULL]` + refcount-underflow asserts | 5/5 exit=134/139 |
| 3 state B ×5 | ksem, `PROP_WIDEN2_MS=50` | `VIOLATION[B:value=stale]` (typed object, `prop_bool_true()==false`) | 5/5 exit=134/139 |
| 4 release ×5 | ksem, `PROP_WIDEN_MS=50 release` | SIGSEGV (exit 139) releasing `po_type==NULL` object | 5/5 exit=139 |
| 5 fix ×5 | ksem + `warmup` (= SYSINIT bootstrap of fix.diff) | survive | 5/5 exit=0 |
| 6 realistic ×300 | ksem, NO widening, fresh processes | ~0 anomalies (why this is Low, not High) | 4/300 anomalies; run.2.log again 4/300 |

The `PROP_WIDEN_MS` / `PROP_WIDEN2_MS` knobs are rig instrumentation only
(read once by a constructor so the un-widened path costs two branches; an
earlier getenv-inside-init version self-widened the window — see
`run.first-attempt.log` and VERDICT.md §"rig artifact").

## Guest kernel repro

Not feasible in a bounded run: the kernel once-flag is **one-shot per
boot** (nothing consumes prop_bool during boot; first use is the first
`<true/>` ever internalized, e.g. via a dm ioctl plist), and the window
is the duration of `_prop_bool_init` (≈4 stores + 2 calls). The rig
(8 threads racing a realistic-length init) hits at ~1.3% per fresh
process under KVM vCPU preemption; the in-kernel hit probability per
boot is far lower on bare metal, and each attempt costs a reboot.
Same classification as DF-5681 (not_reproduced on the kernel binary,
mechanism proven in the differential rig).

## Fix

`fix.diff` — SYSINIT(SI_SUB_PROP) bootstrap, `#ifdef _KERNEL`-guarded so
the shared userland libprop build stays intact. Section 5 emulates it
(warmup) and survives with the window still artificially widened.