DF-5568 — vkernel64 vktimer_intr_reload(): wakeup CAS loop is dead code ((sysclock_t) … < 0 unsigned compare)

What

sys/platform/vkernel64/platform/systimer.c:301-303:

    if (vktimer_cotd && (ssysclock_t)(reload - vktimer_target) < 0) {
        while ((sysclock_t)(reload - vktimer_target) < 0)      /* <-- BUG */
            reload = atomic_swap_long(&vktimer_target, reload);
        cothread_wakeup(vktimer_cotd, &vktimer_ts);
    }

sysclock_t is __uint64_t (sys/sys/systimer.h:51). The while condition casts the wrap-around delta to an unsigned type and then compares < 0 — always false. The loop body (atomic_swap_long target lowering, the lock-free protocol intended to pull vktimer_target down to the earliest deadline seen by any vcpu) never executes. The if five lines up uses the correct (ssysclock_t) (int64_t) cast for the identical expression — the while cast is a typo.

Consequences (all measured, see run logs): - the atomic target-lowering protocol is inert; vktimer_target is only ever updated by the cothread itself (systimer.c:263); - every earlier-than-stale-target reload re-fires cothread_wakeup() → pthread_kill(SIGINT) (cothread.c:192-197) instead of only those that lower the target — redundant signal churn under dense one-shot timer load (checklist (a) amplification); - the intended narrowing of the reload-vs-cothread wakeup race is absent.

NOT affected: timer delivery itself — 10 ms sleeps are exact (ratio 1.000) and the vkernel runs to completion on both builds; the 1 ms-sleep 10x quantization seen in both runs is the documented coarse-timer clamp at systimer.c:275-282 (use_precise_timer == 0, default per init.c:126; -t boot flag enables precise mode) — it is identical before and after the fix.

How it was proven (A/B instrumented kernels)

Two vkernel64 kernels were built in the guest (nativekernel KERNCONF=VKERNEL64, DF-5474 --defsym link workaround):

• kernel.instr — stock logic + two counters exposed as debug.vkt_if (entries into the if body) and debug.vkt_swap (executions of the while body). See instr.diff.
• kernel.fixed — same + the one-cast fix ((sysclock_t) → (ssysclock_t) in the while). See instrfix.diff (verification build) and fix.diff (the clean, shippable fix).

Each kernel booted with -n 2 on /vkroot2.img; inside the vkernel: counter read T0 → drift (timer sanity) → two 20 s hog processes (dense 2 ms one-shot sleeps driving vktimer_intr_reload) → counter read T1.

42,294 opportunities, zero executions on stock; ~1:1 execution with the fix. The only delta between the two kernels is the cast. QED.

Reproduce

On the DragonFly guest as root (files from this pack in /root):

sh build.sh          # binaries + /vkroot2.img + kernel.instr + kernel.fixed
sh run.sh /root/kernel.instr instr    # stock   -> expect vkt_swap: 0
sh run.sh /root/kernel.fixed fixed    # patched -> expect vkt_swap > 0

Expected decisive output (inside the vkernel console, after the hogs):

# sysctl debug.vkt_if; sysctl debug.vkt_swap
debug.vkt_if: 42294          (stock: large)
debug.vkt_swap: 0            (stock: ZERO  -> CAS body dead)

mkdir -p /var/vkernel and sysctl vm.vkernel_enable=1 are required before the first boot. Root fs is specified as ufs:vkd0 at the mountroot> prompt (fed automatically by run.sh).

Fix

fix.diff — one-character-class change:

-       while ((sysclock_t)(reload - vktimer_target) < 0)
+       while ((ssysclock_t)(reload - vktimer_target) < 0)

Validated: with the fix the loop executes under the same workload, timer behavior is unchanged (drift 1.000 both builds, hogs complete, no panic), and the vkernel stays alive.

DF-5568 — VERDICT

Status: reproduced (dead code proven at scale, A/B against the one-cast fix). Impact: none (correctness / redundant-signal-churn defect; no memory safety, no privilege, no leak, no hang). Severity: Low. Confidence: certain.

Root cause (static)

sys/platform/vkernel64/platform/systimer.c:301-303:

if (vktimer_cotd && (ssysclock_t)(reload - vktimer_target) < 0) {
    while ((sysclock_t)(reload - vktimer_target) < 0)
        reload = atomic_swap_long(&vktimer_target, reload);
    cothread_wakeup(vktimer_cotd, &vktimer_ts);
}

sysclock_t = __uint64_t (sys/sys/systimer.h:51); ssysclock_t = int64_t (sys/sys/systimer.h:52). (sysclock_t)(x) < 0 is always false for an unsigned type, so the while body — the atomic_swap_long() that lowers vktimer_target to the earliest deadline any vcpu has programmed — is dead code. The if on the line above evaluates the identical expression with the correct (ssysclock_t) cast; the while's cast is a typo.

What the dead protocol was for

vktimer_target is the cothread's next-wake deadline (vktimer_thread(), systimer.c:262-263). When a vcpu programs a one-shot systimer earlier than that deadline, vktimer_intr_reload() wants to (a) atomically pull the target down and (b) kick the cothread (cothread_wakeup() → zeroes vktimer_ts + pthread_kill(SIGINT), cothread.c:192-197). With the loop dead, only (b) happens, and (b) is re-fired for every earlier-than-stale-target reload rather than only those that lower the target — redundant pthread_kill(SIGINT) churn under dense one-shot timer load (the vkernel "signal storm" surface), plus the loss of the intended race-window narrowing between vktimer_reload[] stores (systimer.c:300) and the cothread's rescan (systimer.c:254-274).

Verification (DragonFly guest, vkernel64 rig after DF-5337/DF-5538/DF-5556)

Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 (X86_64_GENERIC, hw.ncpu=6), cc 8.3 [DragonFly].

Built two vkernel64 kernels from the guest's /usr/src (make -j6 nativekernel KERNCONF=VKERNEL64, DF-5474 link workaround:

• kernel.instr: stock logic + counters debug.vkt_if / debug.vkt_swap (instr.diff);
• kernel.fixed: + the one-cast fix (instrfix.diff; clean fix in fix.diff).

Booted each with -m 512m -r /vkroot2.img -n 2 -e init_path=/bin/vkinit; inside: T0 counters → drift → two 20 s hogs (2 ms clock_nanosleep loops) → T1 counters.

Results (run.instr.log, run.fixed.log)

• Stock: the if body ran 42,294 times; the while body ran 0 times. Dead code proven at scale (idle boot alone produced 16,042 if entries).
• Fixed: the while body runs ~1:1 with the if (slightly more — multiple iterations under contention), i.e. the intended atomic target-lowering protocol is restored by the single cast change.
• No functional regression: DRIFT10MS ratio 1.000 on both builds, hogs complete (HOGS_RC=0), vkernel ALIVE_AT_END on both builds, no panic, no watchdog.
• DRIFT1MS ratio 10.000 (identical both builds) is the documented coarse-timer clamp systimer.c:275-282 with use_precise_timer = 0 (default, init.c:126; -t enables precise mode) — pre-existing designed behavior, not this finding, and unaffected by the fix.

Fix validation

• Baseline reproduces the defect (vkt_swap = 0 despite 42k opportunities): fix_baseline_reproduced = true.
• Patched kernel: defect gone (vkt_swap > 0), timer function unchanged (drift identical, workload completes, vkernel alive): fix_patched_reproduced = true → fix_status = fixed.

Why severity is Low (negative results that bound it)

• No memory-safety surface in the file: no copyin/copyout, no dynamic allocation after boot, arrays indexed only by gd_cpuid < MAXCPU (systimer.c:300; optcpus clamped 1..MAXCPU at init.c:395-397); cothread reads of vktimer_reload[]/vktimer_target are aligned 64-bit scalars (tear-free on x86_64).
• No missed-wakeup hang: the cothread recomputes vktimer_target from vktimer_reload[] every pass and sleeps for the min delta; even a stale target can only cause extra wakeups, not fewer (systimer.c:246-283).
• No teardown UAF: vktimer_cotd is never destroyed (no cothread_delete() caller for it; rg over vkernel64).
• Boot-order race killed: ap_tids[] is populated synchronously by mp_start() at SI_BOOT2_START_CPU (autoconf.c:101,199, mp.c:403,464-470) which precedes SI_BOOT2_CLOCKREG (kernel.h:158,162; systimer.c:136), so the cothread never signals a nonexistent thread; pthread_kill(ap_tids[n], SIGURG) (systimer.c:258) is safe post-boot.
• Runtime re-selection of the interrupt cputimer can't re-run vktimer_intr_initclock() (no second cothread): initclock runs only from the SI_ORDER_SECOND sysinit (kern_cputimer.c:432-465), and with a single registered "vkernel" intr timer the kern.cputimer_intr.select sysctl re-selects the same object (kern_cputimer.c:518-521).
• sys_cputimer swap is boot-time-only over static structures (dummy_cputimer → vkernel_cputimer, kern_cputimer.c:84-117), count() is stateless — no cothread-vs-swap UAF.
• Reload arithmetic is clamped (systimer.c:295-299: negative→1, ≥freq→freq); muldivu64(reload ≤ freq-1, 1e9, freq) cannot overflow and yields tv_nsec < 1e9 (systimer.c:283).

Rig notes (what had to be fixed vs the seed)

• mkdir -p /var/vkernel + sysctl vm.vkernel_enable=1 required before first boot (fresh guest snapshot).
• The run-monitor must not grep for a marker that appears in the echoed fifo input (first run self-terminated early) — output-only marker TERMINUS: 42 used instead.
• fix.diff is generated against the pristine file; the instrumented verification build needs the combined instrfix.diff (instrumentation
• cast) — applying fix.diff on top of instr.diff fails on context (braces added around the while body) by construction.
• uname didn't land in the image (cp silently skipped); kern.clockrate used instead — cosmetic only.

Artifacts

instr.diff, instrfix.diff, fix.diff, drift.c, hog.c, build.sh, run.sh, build.instr.log, build.fixed.log, run.instr.log, run.fixed.log, vkcon.instr.log, vkcon.fixed.log, env.txt, manifest.json, verdict.json.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.