DF-5661 — VERDICT

Status: reproduced (impact: dos — the vkernel's shutdown mechanism silently fails; SIGTERM cannot stop a booting vkernel or any vkernel whose pid 1 is not real init(8); host shutdown leaves the vkernel running and it is killed uncleanly underneath, with dirty guest disk images).

Mechanism (certain)

1. Host SIGTERM → vkernel shutdownsig (shutdown.c:77) → signalintr(2) (machintr.c:169) → INT2 ithread → shutdown_intr (shutdown.c:91): kprintf("Caught SIGTERM ... Shutting down...\n") then ksignal(initproc, SIGUSR2) (shutdown.c:95) — init(8)'s poweroff trigger (sbin/init/init.c:1343).
2. If pid 1 has not armed a SIGUSR2 handler yet — the entire boot window (create_init at SI_SUB_CREATE_INIT runs long before start_init execs, and handlers are only installed after exec) — or ever (non-init(8) pid 1): kern_sig's issignal loop hits case SIG_DFL: → if (p->p_pid <= 1) break; /* == ignore */ (kern_sig.c:2134-2144). The signal is posted and silently discarded.
3. execsigs() (kern_sig.c:426-445) resets only caught signals, so a SIGUSR2 posted while start_init is still building/exec'ing the first image cannot be rescued by exec either.

Live proof (rig: VKERNEL64 on the DragonFly guest, /vkroot.img,

init_path=/bin/vkinit → sh as pid 1)

• run.midboot.noop.log + wedge_probe.log: kill -TERM mid-boot and post-boot → "Caught SIGTERM from host system. Shutting down..." → the vkernel stays alive indefinitely (S5, minutes observed); the operator's stop signal has no effect.
• Guest liveness proven post-SIGTERM by console injection: echo GUEST_ALIVE_OK executed; kill -USR2 1; echo STILL_HERE… printed STILL_HERE_AFTER_USR2 — pid 1 ignores SIGUSR2 via the pid≤1 guard; no panic, no death, no shutdown.
• At-scale variant: a SIGTERM burst during boot yields a stream of "Shutting down..." lines while boot proceeds normally (bootlog_excerpt.txt; hundreds of hits, zero effect).

Impact ceiling

Not memory corruption; a reliability/availability defect with data-loss adjacency: host shutdown scripts (killall TERM, rc.d vkernel stop, lockf-based pidfile scripts — the machinery init.c:1375-1404 exists to support) silently fail against a booting vkernel; the host then powers off under the still-running vkernel → unclean guest disk state, stale locked pidfile. Trigger needs only the ability to signal the vkernel (same uid or root), i.e. exactly the documented operational path.

Fix validation (fixed)

fix.diff = gate the ksignal on ps_sigcatch (the kernel's own delivery criterion) and route the fallback through the in-kernel shutdown_nice(RB_POWEROFF|RB_HALT) path, plus the two kern_shutdown.c hardening hunks (shutdown_nice's identical blind-SIGINT bug; the curproc==NULL kern_closefrom assertion that fires when boot() runs from ithread context — hit live during validation and fixed).

Patched kernel, handler-less pid 1 (vkinit3, standing in for pre-arm init(8)), same kill -TERM: run.fixboot.log shows the complete clean kernel-side halt (boot() called on cpu#0 … The operating system has halted. … cpu halt, exiting vkernel, monitor exit, FIXB RESULT: exited) — the no-op is gone, the vkernel stops cleanly, the guest host is untouched.

Why not uid0

No memory-safety primitive: a dropped signal. The deliverable is the demonstrated silent-failure of the kernel's own shutdown path and its clean repair.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.