DF-5607 — VERDICT

Status: reproduced (3/3 deterministic on a real VKERNEL64 boot). Impact: dos (silent whole-vkernel death — strictly worse than a panic: no message, no dump, no trace). Confidence: certain.

What was proven, and how

The finding is the cothread.c-owned enabling condition of the DF-5587 dynamic. DF-5587 demonstrated the recursion with a standalone host program (coresig.c) modeling the vkernel's signal installs. This pack upgrades the proof to a real vkernel: a stock VKERNEL64 kernel.debug built from the guest's /usr/src, booted -m 512m -r /vkroot.img -n 2, with an LD_PRELOAD shim (cotdfault.so, no sys/ modification) that:

1. interposes sigblock() for diagnostics — every cpu_mask_all_signals() (machintr.c:205-211, called at cothread.c:109 and cothread.c:143) passes through it;
2. interposes nanosleep() — the vktimer cothread reaches it via cothread_sleep() (cothread.c:186-189, called from vktimer_thread, systimer.c:244) after tls_set_gs(0) (cothread.c:149) executed; the shim confirms the caller is a cothread by reading its %gs base with the get_tls_area(2) syscall (nr 473) — NULL only for cothreads;
3. injects pthread_kill(self, SIGSEGV) there — indistinguishable from any real cothread-side fault (in-tree example: the deliberate *(volatile int *)0 = 1 NULL-ring write in vke_rx_thread, if_vke.c:672-675).

Observations (stock kernel)

• Console at the moment of injection (run.baseline.log): COTDFAULT: ... injecting SIGSEGV ... — then silence. The vkernel child dies without panic, without Fatal trap, without a core note on the console, without the ddb Debugger() path. The init.c fork wrapper (init.c:203-222) swallows the child's status and exits 0, so even the parent's exit status is unremarkable.
• The child's core (baseline_core.txt): Program terminated with signal 4, Illegal instruction — the host killed it when the recursive signal-frame pushes exhausted the cothread's pthread stack. Deepest frame: #0 _get_mycpu () at ./machine/thread.h:77 (movq %gs:globaldata — the mycpu load that re-faults with %gs=0), under #1 kern_trap (trap.c:585) under #2 exc_segfault (exception.c:269) — the recursion ladder itself. The two vkernel cpu threads are parked in nanosleep() (gdb info threads), i.e. no cpu thread ever ran the panic path.
• 3/3 deterministic (three separate boots).

Root cause chain (path:line)

• sys/platform/vkernel64/platform/cothread.c:149 — tls_set_gs(0, ...) makes every mycpu dereference fatal in a cothread (by design).
• sys/platform/vkernel64/platform/cothread.c:109 and :143 — the cothread's signal discipline is cpu_mask_all_signals(), which blocks only SIGALRM|SIGIO|SIGQUIT|SIGUSR1|SIGTERM|SIGWINCH|SIGUSR2|SIGURG (sys/platform/vkernel64/platform/machintr.c:205-211) — not SIGSEGV/SIGBUS/SIGTRAP/SIGFPE.
• sys/platform/vkernel64/x86_64/exception.c:227-233 — those fault signals are handled process-wide by exc_segfault, installed SA_SIGINFO|SA_NODEFER with an empty sa_mask, so a fault taken inside the handler is re-delivered on the same stack, unbounded.
• sys/platform/vkernel64/x86_64/trap.c:585 — kern_trap()'s first statement is the mycpu load that re-faults.

Masking the fault signals in the cothread instead is NOT a correct fix: a blocked synchronous signal makes the host retry the faulting instruction forever (silent livelock). The actionable fix is the re-entrancy guard in exc_segfault (cross-file, shared with DF-5587); cothread.c's contribution is the invariant documentation and the fact that its mask discipline is what leaves the thread exposed.

Fix validation (performed in this run)

fix.diff: __thread int exc_nesting guard; on re-entry print vkernel: recursive fault in exc_segfault, restore SIG_DFL, unblock, raise(signo). Applied to the guest's /usr/src (validation copy only), VKERNEL64 rebuilt (log RC=0), same injection re-run (run.fixed.log):

• console: vkernel: recursive fault in exc_segfault then death — a diagnosable failure for the first time;
• core (fixed_core.txt): Program terminated with signal 11, Segmentation fault with the raise → _thr_send_sig → lwp_kill path — the honest SIGSEGV, exactly 2 handler entries instead of ~308k.

Baseline vs patched: silent-SIGILL-recursion vs diagnostic-SIGSEGV. Bad behavior gone. (This also upgrades DF-5587's fix from simulated-only to real-vkernel-validated.)

Why not uid0

The vkernel is a host userland process; this bug class kills the vkernel instance (DoS of the virtual kernel) and provides no memory corruption primitive — the recursion is deterministic death, not control over saved state.

Environment

env.txt; guest DragonFly 6.5-DEVELOPMENT X86_64_GENERIC #0 Thu Jul 2 2026; VKERNEL64 built in-guest with the DF-5474 defsym workaround; vkernel boots SMP (-n 2) with /vkroot.img (rig lineage DF-5337/DF-5579).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.