DF-5608 — VERDICT

Status: reproduced (runtime, one traced boot + one confirmation boot). Impact: none (functional/operational regression — no memory safety, no DoS; SIGTERM/SIGKILL still work). Confidence: certain.

What was proven

On a real VKERNEL64 boot with an LD_PRELOAD sigaction() tracer:

1. The console subsystem installs vconssignal for SIGINT early (console.c:344-360; traced install handler=0x72b6d0 flags=0, nm: vconssignal).
2. At initclocks the vktimer cothread — a different pthread — installs the empty SA_NODEFER latch (handler=0x72aa00 flags=0x10, nm: vktimer_sigint; systimer.c:223-227), which being a process-wide sigaction() replaces vconssignal. This replacement is REQUIRED by cothread_wakeup()'s choice of SIGINT as the thread-directed wakeup vector (cothread.c:196): SIGINT is not in cpu_mask_all_signals()'s set (machintr.c:205), so without hijacking the disposition the wakeup SIGINT would run whatever handler the process had — in the cothread, with %gs=0 (see DF-5607 for what a faulting handler does there).
3. Behavioral consequence, live: three kill -INTs to the booted vkernel child leave it ALIVE — host ^C is dead post-boot (vconssignal never runs: no terminal restore, no clean re-raise). Control: SIGTERM still reaches the console handler path ("Caught SIGTERM from host system. Shutting down...").

Root cause is shared between cothread.c (the SIGINT vector choice at cothread.c:196 — a signal the process ALSO uses for console control) and systimer.c (the process-wide latch at :227). The console's ^C feature is silently lost after boot; the operator must use SIGTERM (wrapper forwards it, init.c:216-219) or SIGKILL.

Fix direction

The wakeup vector should not be a signal with existing process-wide meaning. Options: use a dedicated unused signal (e.g. one of the realtime signals) for cothread_wakeup() — blocking it in every cothread via cpu_mask_all_signals() (machintr.c) — or save/restore the previous SIGINT disposition and chain to vconssignal from vktimer_sigint when the signal is process-directed rather than thread-directed. No fix.diff authored (Low severity, no memory-safety impact; behavioral evidence only).

Environment

Same rig as DF-5607 (guest DragonFly 6.5-DEVELOPMENT, VKERNEL64 in-guest build, /vkroot.img, -n 2).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)