{
  "finding_id": "DF-5840",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Info-grade hardening finding, verification intentionally skipped per the audit contract (no memory-safety consequence): lwkt_rele() (lwkt_thread.c:502-507) never wakes the td_refs drain pollers - lwkt_exit()s tsleep(td,0,\"tdreap\",1) at :1708-1711 and lwp_wait()s tsleep(td,0,\"lwpwait2\",1) at kern_exit.c:857-859 - so every teardown behind a held reference is delayed by up to one tick after the last release and the poller burns scheduler cycles meanwhile. Correctness is preserved (the polls drain the refcount); impact is bounded teardown latency and scheduler load only. One-line fix: wakeup(td) on the 1->0 transition in lwkt_rele().",
  "exploit_chain": "",
  "evidence": [
    "sys/kern/lwkt_thread.c:502-507 (rele without wakeup)",
    "sys/kern/lwkt_thread.c:1708-1711 (tdreap 1-tick poll)",
    "sys/kern/kern_exit.c:857-859 (lwpwait2 1-tick poll)"
  ],
  "kernel_refs": [
    "sys/kern/lwkt_thread.c:502-507",
    "sys/kern/lwkt_thread.c:1708-1711",
    "sys/kern/kern_exit.c:857-859"
  ],
  "poc_changes": "no PoC built (Info hardening; skipped per contract)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Teardown latency only; no corruption/leak/DoS achievable. Recommended fix: add wakeup(td) on the 1->0 refcount transition in lwkt_rele().",
  "recommended_fix": "lwkt_rele(): issue wakeup(td) when the decrement reaches zero (both poll sites sleep on td as their ident).",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Not applicable: verification skipped for this Info hardening finding; the one-line fix is low-risk and mechanically obvious.",
  "fix_evidence": []
}