Summary

kthread_stop() waits for target kthread to die using tsleep(kthread_stop 0 kstop hz) but no code anywhere in tree ever calls wakeup(kthread_stop) so sleep ALWAYS times out after exactly 1 second regardless of thread exit. Then unconditionally calls lwkt_free_thread(ts->dfly_td) which on still-running thread either panics (DEBUG KKASSERT TDF_RUNNING lwkt_thread.c:513) or returns live thread struct thread to thread_cache while still executing (UAF); on thread that already exited via lwkt_exit double-frees it (lwkt_exit already cached td in gd->gd_freetd at lwkt_thread.c:1742 for next exiting thread to objcache_put). Three failure modes: (a) thread still running TDF_RUNNING set DEBUG KKASSERT panic production silently objcache_put live thread stack/registers returned to thread_cache handed to fresh lwkt_alloc_thread while original kthread still executing = arbitrary memory corruption/RCE primitive; (b) thread already exited via lwkt_exit but gd->gd_freetd not drained double-free thread_cache; (c) thread already exited and drained same double-free different timing. Reachable: unprivileged /dev/dri/renderD* user submits hostile GPU command buffer triggers GPU hang; amdgpu/i915 TDR calls drm_sched_fini->kthread_stop while scheduler thread still blocked in run_job/wait_event on hung hardware. Also reachable via kldunload drm operator.