DF-3029 verdict — NOT REPRODUCED in bounded stress (defect stands by analysis)

Root cause (path:line)

sys/vfs/fuse/fuse_vnops.c:2013-2023 (fuse_io_thread) vs sys/vfs/fuse/fuse_vnops.c:1682-1693 (fuse_vop_strategy producer: spin_lock; TAILQ_INSERT; spin_unlock; wakeup).

Classic lost wakeup: the consumer's queue-empty decision is not interlocked with its tsleep. If the producer's wakeup() lands in the instructions between the helper's spin_unlock (after observing an empty queue) and its tsleep, the wakeup is dropped; the queued bio is never processed and its waiter sleeps forever (user read in biowait, or pageout via UIO_NOCOPY strategy). Only a subsequent fuse I/O on the same mount re-wakes the helper; an otherwise-idle mount hangs permanently.

Verification attempt (honest)

8 threads x 240s of randomized 4K preads against a 16MB fuse file (worst-case queue churn, ~2.4M reads/s sustained): 585,939,514 ops, zero stalls. The window is ~tens of nanoseconds against a ~400ns+ syscall loop; a hit is expected only at very low probability per idle-transition (hours-to-days of hammering). Classification: not_reproduced (bounded run), finding confidence likely (the code defect is unambiguous; compare the correct interlocked pattern in fuse_ipc.c:171-175).

Fix

fix.diff restructures the loop to tsleep_interlock + recheck under the spinlock + tsleep(PINTERLOCKED), and also rechecks fmp->dead under the lock for a clean unmount exit. Patched module passes a 120s no-regression smoke (290,965,533 reads, no stall, same throughput). fix_status=not_testable (the race itself cannot be triggered deterministically).