DF-5794 — ttyflush(FREAD|FWRITE) discards the IXOFF resume (VSTART/XON) character

What

sys/kern/tty.c ttyflush() (lines 1430-1492). When a tty is input flow-blocked (TS_TBLOCK set because the raw+canonical input queues passed t_ihiwat with IXOFF/CRTS_IFLOW) and a FREAD|FWRITE flush runs (ioctl(TIOCFLUSH, FREAD|FWRITE), tcflush(TCIOFLUSH), last-close ttyclose() tty.c:254, ttyrevoke() tty.c:2822, pty TIOCREMOTE/ TIOCSIG/master-TIOCSETA* paths in tty_pty.c), the FREAD branch calls ttyunblock() (tty.c:1453), which queues the resume character VSTART (default 0x11/^Q) into t_outq (tty.c:1542) and clears TS_TBLOCK (tty.c:1540). The trailing if (rw & FWRITE) FLUSHQ(&tp->t_outq) (tty.c:1487-1488) then deletes that character from the freshly emptied output queue.

Result: the peer that honoured the earlier XOFF (0x13/^S) — a terminal emulator, a remote tty server, a serial device — is never told to resume transmission, while the kernel state claims it is unblocked (TS_TBLOCK cleared, so neither ttread's low-water ttyunblock (tty.c:1936-1939) nor any other path will re-send XON). The tty input channel is wedged until the peer independently emits VSTART (e.g. a human presses ^Q at the remote end).

Reproduce (guest, unprivileged)

cd findings/poc/DF-5794
cc -O -o df5794 df5794.c
./df5794

Expected (stock kernel):

CONTROL: XOFF (0x13) received by master
CONTROL: XON (0x11) after slave read-drain: SEEN (expected)     <- rig sanity
TEST: XOFF (0x13) received by master; TS_TBLOCK set
TEST: TIOCFLUSH(FREAD|FWRITE) done (master pre-drained)
TEST: XON (0x11) after TCIOFLUSH: NOT SEEN => XON discarded ...  <- BUG
RESULT: BUG REPRODUCED (XON discarded by ttyflush)

CONTROL arm proves the kernel does emit XON via the same ttyunblock() when reached through ttread's low-water path; the TEST arm shows the flush-ordered call's character is destroyed. 6/6 stock runs reproduced; with fix.diff applied and a rebuilt kernel the TEST arm sees the XON (run.fixed.log), i.e. the defect is gone.

Files

• df5794.c — self-contained pty-pair PoC (no privileges, no pts grant games)
• run.log, run.2.log — decisive stock-kernel runs
• run.fixed.log — patched-kernel run (fix validated)
• fix.diff — minimal reorder: move the TS_TBLOCK unblock after the final output flush
• fix_build.log, fix_run.log — single-fix kernel build + rerun evidence
• env.txt, build.log, code_hash.txt

DF-5794 — VERDICT

Status: reproduced (stock), fixed (patched-kernel validation passed). Impact: dos — per-terminal input-channel wedge via lost IXOFF resume char. Confidence: certain.

Root cause (line-accurate)

ttyflush() in sys/kern/tty.c executes, for rw == FREAD|FWRITE:

1. tty.c:1437-1440 — FLUSHQ(&tp->t_outq) (1st), clear TS_TTSTOP;
2. tty.c:1441 — driver t_stop;
3. tty.c:1442-1449 — FREAD: flush t_canq/t_rawq, clear PENDIN, ttwakeup;
4. tty.c:1450-1485 — if TS_TBLOCK (input flow-blocked with IXOFF): tty.c:1451-1452 flushes t_outq a 2nd time to make room for the START char; tty.c:1453 ttyunblock(tp) queues VSTART into the now-empty t_outq (tty_subr.c clist_putc via tty.c:1541-1542), clears TS_TBLOCK (tty.c:1540) and ttstart()s it; tty.c:1462 clears TS_TBLOCK again;
5. tty.c:1487-1488 — trailing if (rw & FWRITE) { FLUSHQ(&tp->t_outq); ttwwakeup; } — this deletes the VSTART queued in step 4.

After the flush the kernel believes the line is unblocked (TS_TBLOCK clear), so the only re-send trigger in the tree — ttread's low-water if (ISSET(tp->t_state, TS_TBLOCK) && ... ) ttyunblock(tp); (tty.c:1936-1939) — can never fire. A peer that honoured XOFF is stranded.

The file's own TODO (tty.c:48 "Fix races for sending the start char in ttyflush()") shows the START-char handling was known-fragile; the discard ordering inherited from 4.4BSD was never corrected. This finding is the demonstrated discard, distinct from the TODO's "races" framing.

Reachability

Unprivileged: any open fd of a tty with IXOFF (or CRTS_IFLOW) and input past t_ihiwat-3 (tty.c:427-431), then ioctl(fd, TIOCFLUSH, &(int){FREAD|FWRITE}) — i.e. tcflush(TCIOFLUSH). Implicit triggers: last device close (ttyclose tty.c:254 — every session teardown of a flow-blocked terminal), ttyrevoke (tty.c:2822), pty TIOCREMOTE, TIOCSIG, and master-side TIOCSETA* (tty_pty.c:1163-1255, all call ttyflush(tp, FREAD|FWRITE)). No privilege, no race, deterministic.

Reproduction narrative

Rig: ptmx/pts pair (the rig's own console serial is not touched). Slave in non-canonical mode with IXOFF, echo/OPOST off so the master observes the kernel's flow-control bytes verbatim.

• Fill slave input with 768 bytes > t_ihiwat (512 for the pty old-driver watermark case, tty.c:2447) → kernel sends XOFF to master (observed 0x13).
• CONTROL arm: slave read()s the queue empty → ttread out-path ttyunblock → XON (0x11) observed at master. Proves the emit machinery works and the watermark math of the rig is right.
• TEST arm: ioctl(slave, TIOCFLUSH, FREAD|FWRITE) → XON never arrives (2 s watch, repeated); subsequent master→slave traffic still flows, proving the kernel considers itself unblocked while the resume byte was destroyed.

Stock kernel #0: Thu Jul 2 06:02:54 UTC 2026: 6/6 runs "BUG REPRODUCED" (3 with the pre-drain-corrected PoC, 3 with the final PoC; see run.log, run.2.log and the earlier session logs).

Fix validation

fix.diff moves the TS_TBLOCK unblock block after the final output flush (semantics for FREAD-only and FWRITE-only flushes are unchanged; the old inner make-room flush becomes redundant). Applied to the guest's /usr/src (Hunk #1 succeeded at 1447), make nativekernel + installkernel (DragonFly 6.5-DEVELOPMENT #1: Mon Oct 12 20:09:42 UTC 2026), rebooted, reran the identical PoC as uid 1001:

• baseline (stock): XON after TCIOFLUSH: NOT SEEN → BUG REPRODUCED;
• patched: XON after TCIOFLUSH: SEEN → BUG NOT REPRODUCED (defect GONE).

Guest then reset to the clean-source snapshot and left up.

Impact ceiling

Per-tty input denial of service (the terminal's input direction stalls silently until the remote side manually sends ^Q or the tty is reconfigured with IXOFF off/on). Not memory corruption; no escalation path — the primitive is a missing byte in an output queue. Severity Low (DoS, self/peer-recoverable only with out-of-band action; requires IXOFF-enabled terminals which is not the default).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.