Summary

ppsopen uses single int flag sc->pps_open to decide whether ppbus acquired and interrupt registered. Second open by different process skips setup (pps.c:118) returns valid fd. When ANY holder calls close ppsclose unconditionally tears down interrupt (ppb_release_bus ppbconf.c:514-521) and sets pps_open=0 destroying PPS event delivery for all other open fds. ppsclose also ignores return value of ppb_release_bus (pps.c:153). Sequence: process A opens (bus acquired intr registered pps_open=1); process B opens (skips setup valid fd); process B closes ppb_release_bus tears down intr handler releases bus pps_open=0; process A still holds open fd but no PPS interrupts fire PPS_IOC_FETCH blocks until timeout. Subsequent open by C re-acquires bus registers new handler if A closes ppsclose tears down C interrupt cross-process interference. Attacker: local unprivileged opens /dev/ppsN immediately closes tears down ntpd PPS interrupt handler. DoS of kernel PPS timing subsystem. Narrow preconditions (parallel-port hardware + pps driver + victim using it).