DF-5511 -- ppb_release_bus() ctx-save race: context snapshotted after owner clear

What

ppbconf.c:528 clears ppb_owner, then :532 reads ppb_get_mode() into ppbdev->ctx.mode outside any crit section; a competing child acquiring the bus in the window gets its mode saved into the wrong device's context, which ppb_request_bus():491-492 later restores.

Build / run / expected (inside the DragonFly guest)

build (guest): sh build.sh
run   (guest): sh run.sh   # F2 phase runs 10 s
expected pristine: "DF-5511 releaser iterations=50000000 ... WRONG-mode-captured(B's EPP in A's ctx)=N -> REPRODUCED" (N = 2/1/1/6 across runs)
expected patched : "... WRONG-mode-captured ... =0 -> race not hit this run"

Rig

ppbharness2.ko compiles the VERBATIM production sources /usr/src/sys/bus/ppbus/{ppbconf.c,ppb_1284.c,ppb_base.c}; a fake "ppc" controller on nexus provides a fully scripted (malicious) IEEE1284 peer. Details in VERDICT.md; shared rig sources in the DF-5510 pack (identical copies here).

DF-5511 VERDICT

ppb_release_bus() ctx-save race: context snapshotted after owner clear

REPRODUCED (rig) 4/4 fresh-boot runs

Deterministic attribution: only device A's own ppb_release_bus() writes A's ppbdev->ctx.mode, and the releaser thread checks it immediately after its release call returns; a capture of B's mode (PPB_EPP) can only have been read from ppb->mode AFTER B interposed between A's owner-clear (:528) and A's get_mode (:532).

Hits: 2, 1, 1, 6 wrong captures per 50M release iterations on the 6-vCPU guest (window is a handful of instructions).

Impact ceiling: the corrupted context is restored at A's next ppb_request_bus (:491-492), so device A afterwards operates the shared port in device B's IEEE1284 chipset mode (e.g. an lpt printer driven in EPP/ECP framing, or pcfclock's bit-banged protocol running in the wrong mode) -> data corruption / hung transfers on the parallel port. No memory-safety consequence. All ppbus children (lpt, ppi, pcfclock) share one bus, but their device nodes are 0600 root:wheel by default, so this needs privileged (or physically local) access plus real hardware.

FIX VALIDATED: saving ctx.{mode,valid} inside the crit section before clearing the owner yields 0 wrong captures in 50M iterations on two patched boots (fixrun1/fixrun2), vs 1-6 per run on pristine.

-- status=reproduced reproduced=True impact=none confidence=certain fix_status=fixed (baseline reproduced, patched behavior gone)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.