Summary

sn_pccard_detach() acquires ifp->if_serializer on line 115 performs work then on line 118 calls lwkt_serialize_enter(ifp->if_serializer) a SECOND time with no intervening lwkt_serialize_exit(). Must be _exit. DragonFlyBSD lwkt serializer explicitly documented non-recursive (sys/sys/serialize.h:41-43). ASSERT_NOT_SERIALIZED(s) = KKASSERT((ss)->last_td != curthread) (serialize.h:60-62) unconditional in DragonFlyBSD (systm.h:98-101 not gated on INVARIANTS). After first enter s->last_td==curthread bus_teardown_intr does not touch last_td so second enter assertion fires guaranteed panic. If assertion elided atomic_intr_cond_enter would self-deadlock spinning on bit 31 pegging CPU 100%. Triggered by every device_detach of sn pccard unit: root kldunload if_sn walks devclass_t calls device_detach; ACPI suspend/resume detaches/reattaches pccard; physical PC Card ejection hotplug path needs NO user credentials only physical proximity. Impact unconditional kernel panic reboot or permanently wedged CPU eventual watchdog panic. Pure availability/DoS no confidentiality/integrity impact no priv-esc. device sn in GENERIC for many laptop configs module auto-loads on card insertion.