Summary

wait_on_bit_timeout() checks bit then calls plain tsleep(word mode ... timeout) WITHOUT first calling tsleep_interlock(word...) and WITHOUT passing PINTERLOCKED. Window between test_bit() at line 111 (and loop re-check at 123) and moment tsleep() internally enters critical section and interlocks thread onto sleep queue (kern_synch.c:582-584). A wake_up_bit() (wakeup_one(word)) delivered from another CPU during that window finds no waiter silently dropped. With infinite timeout (wait_on_bit() wrapper at line 141 passes MAX_SCHEDULE_TIMEOUT) calling thread sleeps forever; bit may already be clear but thread never notices. Canonical DFly pattern (sibling __wait_event_common at wait.h:130-133: tsleep_interlock(current flags); tsleep(current PINTERLOCKED|flags ...)) interlocks first then re-tests condition then sleeps with PINTERLOCKED. Compounding: line 118 passes mode (1 or 2) as tsleep priority without PCATCH so TASK_INTERRUPTIBLE waits cannot be aborted by signals hung thread cannot even be SIGKILL-ed. Reachable: i915_irq.c:3338-3343 spins test_and_set_bit on contention calls wait_on_bit TASK_UNINTERRUPTIBLE. Reset worker clears bit + wake_up_bit at 3319-3322. If clear+wakeup lands in window between test_bit and tsleep interlock wakeup lost waiter sleeps forever. GPU reset backoff path wedges subsequent resets block indefinitely GPU stays hung /dev/dri blocks. Systemic local DoS.