wdog_disable() self-deadlocks/livelocks the panic path when panic strikes inside wdog_reset_all (WDOG_DISABLE_ON_PANIC)

Summary

When the kernel panics while wdog_reset_all holds wdogmtx — i.e. a panic anywhere inside a driver callback, which DF-0236 forces to execute under the held spinlock — the WDOG_DISABLE_ON_PANIC hook calls wdog_disable(), which first does a synchronous callout_stop and then wdog_set_period(0) → spin_lock(&wdogmtx) on the lock the panicking thread itself holds. DFly spinlocks have no recursion guard, so the panic path spins forever with preemption disabled: the machine never reaches crash dump or reboot. Additionally the callout_stop wait loop livelocks if the callout is INPROG on a wedged CPU. Loss of the crash-dump/reboot-on-panic guarantee on hosts running a WDOG_DISABLE_ON_PANIC kernel (opt-in; documented only in LINT64) with an attached ichwd/amdsbwd watchdog. Availability-only; no memory-safety impact. Not guest-verified (stock GENERIC lacks the option and has no registered watchdog — verified via kern.conftxt + dmesg). Fix: panic-safe wdog_disable (skip lock-dependent work when panicstr; row diff).

Timeline

• 2026-09-02 Discovered during pass-2 audit of kern_wdog.c (GLM 5.3). DF-0234..0238 re-verified still present, not re-reported.