DF-5512 -- ppbus_setup_intr() overlapping registrations corrupt forced-teardown bookkeeping

What

ppbconf.c:426-427 unconditionally overwrite ppbdev->intr_cookie/intr_resource; a second registration (reachable via lpt.c write-error paths that keep the bus) orphans the first handler -- ppb_release_bus():514-521 can then only tear down the last one.

Build / run / expected (inside the DragonFly guest)

build (guest): sh build.sh
run   (guest): sh run.sh   # deterministic F3 section
expected pristine: "setup#2 err=0 ck2=0x1001 ivars.cookie=0x1001" then "after ppb_release_bus: parent setups=2 teardowns=1 still-live=1 ... REPRODUCED"
expected patched : "setup#2 err=16 (EBUSY) ... still-live=0"

Rig

ppbharness2.ko compiles the VERBATIM production sources /usr/src/sys/bus/ppbus/{ppbconf.c,ppb_1284.c,ppb_base.c}; a fake "ppc" controller on nexus provides a fully scripted (malicious) IEEE1284 peer. Details in VERDICT.md; shared rig sources in the DF-5510 pack (identical copies here).

DF-5512 VERDICT

ppbus_setup_intr() overlapping registrations corrupt forced-teardown bookkeeping

REPRODUCED (rig) 4/4 fresh-boot runs (deterministic test)

The rig registers the same child handler twice while it owns the bus -- the exact sequence lpt.c produces after an interrupted lptwrite (lpt.c:745 takes the bus and registers lpt_intr; error returns at :778/:784/:799/:810 keep the bus and the handler; the next lptwrite re-registers because HAVEBUS short-circuits the request). ppc.c's setup_intr layer chains handlers (shared-IRQ support), so the duplicate succeeds.

Observed: ppbus ivars hold only cookie #2 after the overwrite; on ppb_release_bus() the forced teardown removes exactly one registration; ONE handler remains live at the parent bus while ppbus bookkeeping says none is registered -- the bus layer's force-unregistration guarantee is void and each interrupted-write cycle adds another permanent handler (every port ACK then runs lpt_intr repeatedly -> strobed byte-stream corruption; orphans persist until driver detach).

FIX VALIDATED: setup #2 returns EBUSY(16) with the original cookie kept; release tears the single registration down (still-live=0). lpt degrades safely to polled mode on EBUSY (lpt.c:754-757).

-- status=reproduced reproduced=True impact=none confidence=certain fix_status=fixed (baseline reproduced, patched behavior gone)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.