DF-2681 — VERDICT

status: reproduced, impact: dos, confidence: certain.

Reproduced how

dfrec.ko (this pack) is a nexus bus driver that does exactly what the exported API invites: DEVMETHOD(bus_delete_resource, bus_generic_delete_resource), then calls bus_delete_resource() on one of its children from attach.

On the stock INVARIANTS kernel:

dfrec0 on motherboard
dfrec: attached, calling bus_delete_resource() on child

• kldload never returned (> 4 minutes observed; date still worked, ps -ax and kldstat hung, clean shutdown timed out, guest had to be force-killed from the host).
• The follow-up kprintf (dfrec: returned (no bug)) never executed.

Mechanism confirmation (source)

sys/kern/subr_bus.c:3144-3149:

bus_generic_delete_resource(device_t dev, device_t child, int type, int rid)
{
    if (dev->parent)
        BUS_DELETE_RESOURCE(dev, child, type, rid);
}

kobj dispatch (subr_kobj.c:160-191) resolves bus_delete_resource on the first argument; passing dev re-selects this same method → unbounded self-recursion. All sibling wrappers in the same file (bus_generic_setup_intr:3025, teardown_intr:3038, config_intr:3065, alloc_resource:3076, release_resource:3088, activate_resource:3099, deactivate_resource:3110, set_resource:3138) pass dev->parent.

The observed livelock (rather than a stack-overflow trap) is explained by the -O2 tail call: the recursive call is the last statement, so it compiles to a jmp — the loop never grows the stack and never returns, keeping the kldload thread's module lock held forever. A build with a non-tail-call layout overflows the kernel stack instead (same root cause, trap-flavored).

Severity rationale

Root-gated (kldload) and latent (no in-tree driver currently installs the wrapper) → Low. It is still a shipped, exported kernel API whose contract is "propagate to parent"; any kmod using it as designed livelocks the kernel permanently.

Fix validation

Not rebuilt (Low severity, one-line fix): the diff replaces dev with dev->parent, matching every sibling wrapper; with the fix the dispatch terminates at the first ancestor implementing bus_delete_resource or hits the kobj default (kobj_error_method, returns ENXIO) — no recursion.