DF-2824 VERDICT — REPRODUCED (bounded impact)

Bottom line

lf_setlock()'s POSIX deadlock detection (sys/kern/kern_lockf.c:406–413) is single-level and single-file: when about to block, it scans only the blocked list of the same lockf for the conflicting owner:

    if (flags & F_POSIX) {
        TAILQ_FOREACH(brange, &lock->lf_blocked, lf_link) {
            if (brange->lf_owner == range->lf_owner) {
                error = EDEADLK;
                goto do_cleanup;
            }
        }
    }

Any cycle that spans two files therefore closes without EDEADLK and every member hangs in F_SETLKW. Reproduced deterministically on the stock guest: two children, two files, two-phase sync gate; both still blocked after 4 s; POSIX requires EDEADLK for the cycle closer. The PoC then SIGKILLs both — the sleep is PCATCH (kern_lockf.c:427), so this is a killable hang, which is why this is filed Info and not as a hard DoS: the only victims are processes that voluntarily entered F_SETLKW against attacker-held locks (the attacker could equally just hold the lock forever — the missing EDEADLK adds spec non-compliance, not a new privilege-relevant primitive).

Why the check cannot see two-file cycles (path:line)

• The blocker identity is range->lf_owner — the conflicting range's owner (kern_lockf.c:363–377 scan, deadlock check at 406–413).
• Wait records (brange) are enqueued on lock->lf_blocked of the file being waited on (kern_lockf.c:423–426). There is no cross-file registry of "who is currently waiting on what" — the only per-owner wait state lives in the thread's own tsleep — so a walk from the blocker to its own wait is impossible without new state. struct proc has no blocked-lock list; struct lockf has no owner index. Hence single-hop, single-file.
• flock-style locks get no deadlock check at all (if (flags & F_POSIX), kern_lockf.c:406; the in-code XXX at 396–405 acknowledges this).

Reproduction notes

• First harness attempt raced: child1 acquired B before child2 locked it (and an ignored first-lock failure printed a stale errno), yielding a false NOT-REPRODUCED. Fixed with a two-phase gate (both children verify their first lock, signal the parent, and only proceed when the parent opens the gate) and checked return codes. Final harness reproduces 3/3 runs (run.1.log, run.2.log, run.3.log).
• Guest left clean: children reaped, temp files unlinked, locks released on child exit (closef per-close POSIX unlock, kern_descrip.c:3051–3062).

Exploit chain

None — no memory corruption, no info leak. Impact ceiling: unkillable-by- default it is not (PCATCH); an attacker can wedge only processes it can already stall by holding advisory locks. POSIX-conformance defect with a denial-of-service flavor for cooperative lock users (e.g., mail spool / DB lock files shared across users where a malicious co-user holds locks and forces a well-behaved process into an undetected cross-file deadlock instead of the mandated EDEADLK error path).

Fix validation

Not performed (architectural change; no minimal safe diff). Recommended direction: FreeBSD-style lf_owner_t graph (owner objects with blocking links + transitive iterator with visited set), or minimally a per-proc list of active wait records maintained at brange enqueue/dequeue under p_token, walked transitively on the block path. No fix.diff is shipped for this finding because an untested invasive diff would be worse than none.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)