# DF-5793 VERDICT — reproduced (dos: unkillable spin + console/msgbuf flood); fix validated

## Bottom line

**REPRODUCED.** On the stock DragonFly 6.5-DEVELOPMENT guest, an
unprivileged two-thread process triggered the `kern_dup()` reserved-target
retry path at ~8.5% of dup2() attempts; every hit (a) emitted an
unrate-limited `Warning: dup(): target descriptor %d is reserved` line to
the console/dmesg and (b) parked the dup2 thread for a full 1-second
**uninterruptible** tsleep, with the retry loop unbounded while the peer
thread keeps re-reserving descriptors. `kill -9` delivered mid-park did
not take effect for ~1s (measured). The kernel-message flood was even
observed overwriting a kernel panic message on the serial console during
DF-5792 verification (serial_panic_run1.txt). Severity: Low (local DoS /
log flood; the unkillable-window becomes permanent if the reservation
holder blocks indefinitely, e.g. M_WAITOK kmalloc under memory pressure).

## Root cause (path:line)

* `sys/kern/kern_descrip.c:1143-1151` — plain `kprintf` per retry
  iteration + `tsleep(fdp, 0, "fdres", hz)` (flags=0 → not PCATCH) +
  `goto retry` with no attempt bound.
* Reservations spanning blocking work: `sys/kern/sys_pipe.c:290-338`
  (fd1 reserved across the second falloc and both fsetfds — the code
  comment even acknowledges racing dup()s), `sys/kern/kern_event.c:730`,
  `sys/kern/uipc_usrreq.c:1593-1620` (per-fd reservation loop),
  `sys/kern/kern_checkpoint.c:664`.
* Any thread of the process can observe a sibling's in-flight reservation
  by targeting the fd the sibling just allocated (lowest-free is
  predictable).

## Evidence (stock kernel #0, unprivileged user `maxx` uid 1001)

run.log (directed, 10s):

```
spammer: attempts=117 slow=10 err=0 errno_last=9(Bad file descriptor)
directed: pipes=5129795
dmesg reserved-warnings: 10        <- exactly one per 1s park
Warning: dup(): target descriptor 3 is reserved, waiting for it to be resolved   (x10)
```

run2.log (sweep variant, 12s):

```
DF-5793: pipes=4525216 dup2 attempts=16184 slow(>=250ms dup2)=11 err=0
total reserved-warnings now: 22    <- 12 new
```

kill.log (SIGKILL latency, stock):

```
pid=1315
SIGKILL-to-death sec: 1           <- uninterruptible park survives SIGKILL ~1s
warnings: 32
```

Note: only 117 dup2 attempts completed in 10s — each of the 10 hits
consumed a full second parked; steady state is one warning line + one
parked second per hit, per thread, forever.

## Fix validation (kernel #2 `Mon Oct 12 19:39:15 UTC 2026`)

`fix.diff`: `krateprintf(&krate_dupres /* .freq = 1 */, ...)` and
`tsleep(fdp, PCATCH, "fdres", hz)` → `return (EINTR)` on signal.

fixrun.log:

* patched directed run: `errno_last=4 (Interrupted system call)` — the
  once-uninterruptible wait now returns EINTR;
* 4 concurrent rigs × 10s → 10 warning lines total (krate cap; the
  unpatched per-thread rate of 10 lines/10s would give ~40);
* SIGKILL mid-park → death in 0s (vs 1s stock).

**fix_status: fixed** (flood bounded to ≤1 line/sec system-wide;
interruptible; no behavior change for the non-racing dup2 path — the
DF-5792 storms ran 20.8M opens/closes plus dup traffic on the same patched
kernel with zero anomalies).

## Rig notes (what had to be fixed vs a naive PoC)

* dup2() returns the new fd on success (not 0) — a `== 0` success check
  silently miscounts;
* the dup2 *source* fd must live outside the contested range (e.g. dup2'd
  to fd 250) or the churner's close-storm closes it and every dup2
  returns EBADF;
* ssh sessions may run with fd 0 closed — never use fd 0 as the source.

## Environment

Same guest as DF-5792 (see ../DF-5792/env.txt): DragonFly 6.5-DEVELOPMENT
#0 baseline; patched #2 for fix validation. Guest reset afterwards.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.