suspend_kproc holds no reference on the target thread: concurrent kthread_exit yields use-after-free read/write on a recycled struct thread and an unkillable sleeper

Summary

suspend_kproc operates on a caller-supplied struct thread *td without taking a reference (no lwkt_hold(td)) and without checking for exit: if the target daemon calls kthread_exit() while a suspender is inside the protocol, (a) wakeup(td) at :194 and tsleep(td,...) at :196 use a stale sleep identity — with timo=0 (the u4b idiom) the suspender sleeps forever on an identity that will never be woken for it; (b) the loop test td->td_mpflags at :195 reads freed memory; (c) atomic_clear_int(&td->td_mpflags, TDF_MP_STOPREQ) at :200 WRITES to a struct that lwkt_exit has already parked and which may be recycled — clearing STOPREQ on an unrelated thread being legitimately suspended. lwkt_exit's td_refs drain loop is the intended lifetime mechanism this code fails to use. NO currently reachable in-tree instance: the three callers are shutdown_kproc (targets daemons that never exit during shutdown), uvc self-suspend (curthread cannot exit while sleeping), and u4b usb_proc_drain (cold-gated; those threads ignore STOPREQ entirely — that path hangs rather than UAFs). Becomes live memory corruption the day any caller suspends a daemon that can error-exit its main loop. Not triggerable by an unprivileged user (no syscall/ioctl entry). Fix: lwkt_hold/lwkt_drop bracket + TDF_EXITING re-check (row diff).

Timeline

• 2026-09-02 Discovered during pass-2 audit of kern_kthread.c (GLM 5.3). DF-0239..0242 re-verified still present, not re-reported.