DF-3336 — netmap kqfilter is a stub: knotes never fire (functional hang), no detach bookkeeping

Target: sys/net/netmap/netmap.c:1513-1546 (netmap_kqfilter, netmap_kqfilter_event, netmap_kqfilter_detach), wired via netmap_cdevsw.d_kqfilter (netmap_freebsd.c:402).

netmap_kqfilter accepts EVFILT_READ/EVFILT_WRITE and installs netmap_kqfilter_ops, whose event routine always returns 0 (netmap.c:1513-1517) — "never ready". Consequences for any process that uses kevent/kqueue on a netmap fd (standard for event-driven netmap apps):

• kevent() with EV_ADD then wait sleeps forever — the netmap fd never reports readiness even with packets available (the wakeup side, netmap_notify() netmap.c:1815-1834, does KNOTE/wakeup on the selinfo lists, but the knote installed by netmap_kqfilter is never attached to any knlist and f_event returning 0 suppresses the event anyway);
• netmap_kqfilter_detach is a no-op and no knlist_init is performed (netmap.c:1519-1522, 1524-1526) — the knote lifetime is not tracked against the cdevpriv.

No memory-safety impact found (FILTEROP_ISFD + kernel-managed fd knotes; the stub cannot corrupt the kqueue). The sleeping thread IS killable (interruptible sleep), so this is a functional hang / API-completeness defect, not a security DoS. Filed Info. On this tree the subsystem is additionally dead code (does not compile — see DF-3332/env.txt).

Verification: skipped (Info). Fix = implement the real filterops (attach knote to kring->si / na->tx_si/rx_si knlists, event returns ring->avail > 0) or refuse kqfilter with EOPNOTNOTSUP... EOPNOTSUPP so applications fail fast instead of hanging.

DF-3336 — VERDICT (analysis-verified; no runtime PoC — Info)

Read netmap.c:1513-1546 and the cdevsw wiring (netmap_freebsd.c:402). The filterops event handler returns constant 0; detach is empty; no knlist_init anywhere in the file. Cross-checked the wakeup side (netmap_notify, netmap.c:1815-1834): it KNOTEs the kring selinfo lists that kqfilter never attaches the knote to, so even the wakeup path cannot fire the knote. Memory safety: FILTEROP_ISFD keeps the knote owned by the fd table; the stub cannot dangle (detach no-op is safe because nothing was ever attached). Conclusion: functional hang for kevent users, killable, no privilege or memory impact -> Info. Subsystem dead on this tree anyway (if_unused7 bit-rot). No fix.diff: the remedy is an implementation, not a one-liner (or returning EOPNOTSUPP from netmap_kqfilter to fail fast).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)