DF-5513 -- ppb_request_bus() owner self-request sleeps uninterruptibly forever

What

ppbconf.c:466 only tests 'any owner present'; the current owner that re-requests falls into tsleep(ppb, 0, "ppbreq", 0) -- no PCATCH, no timeout; it waits for itself forever. pcfclock_open() (no HAVEBUS guard, bare PPB_WAIT on the 0444 /dev/pcfclock0) is the production trigger (see DF-5029 for the verified end-user path).

Build / run / expected (inside the DragonFly guest)

build (guest): sh build.sh
run   (guest): sh run.sh   # deterministic F4 section (3 s wait)
expected pristine: "DF-5513 REPRODUCED: owner re-requested with PPB_WAIT|PPB_NOINTR is STILL ASLEEP after 3s ... only an explicit release ever wakes it"
expected patched : "DF-5513 not-reproduced: request returned spontaneously ret=0"

Rig

ppbharness2.ko compiles the VERBATIM production sources /usr/src/sys/bus/ppbus/{ppbconf.c,ppb_1284.c,ppb_base.c}; a fake "ppc" controller on nexus provides a fully scripted (malicious) IEEE1284 peer. Details in VERDICT.md; shared rig sources in the DF-5510 pack (identical copies here).

DF-5513 VERDICT

ppb_request_bus() owner self-request sleeps uninterruptibly forever

REPRODUCED (rig) 4/4 fresh-boot runs (deterministic test)

A kernel thread re-requests the bus for the device that already owns it with PPB_WAIT|PPB_NOINTR (what pcfclock_open() passes, since PPB_NOINTR==0): the thread is still in tsleep("ppbreq") after 3 s in every run, and only a ppb_release_bus() from another thread revives it. In production nobody releases on the sleeper's behalf: the owner waits for itself forever, unkillable (no PCATCH), same D-state wedge DF-5029 demonstrated end-to-end on real hardware from userland via the world-readable /dev/pcfclock0. This finding pins the ppbus-side defect and the bus-level fix (idempotency), which also protects any future driver that forgets a HAVEBUS-style guard.

FIX VALIDATED: with the owner==dev early-out the re-request returns 0 immediately (no sleep) on both patched boots.

-- status=reproduced reproduced=True impact=none confidence=certain fix_status=fixed (baseline reproduced, patched behavior gone)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.