In keyboard_poll() of keyboard.c, an unconditional sti at the end of the function re-enabled maskable interrupts regardless of the caller's context. keyboard_poll() is reachable from keyboard_getchar(), which a ring3 .t program can block on via SYS_READ (entered through the int $0x80 interrupt gate, which clears IF for the duration of the syscall by design). The unconditional sti silently re-enabled interrupts in the middle of that syscall handler, allowing the 100Hz PIT timer (int $32) to preempt mid-handler — a nested hardware interrupt occurring while the CPU was already inside another interrupt's own trap-gate handler. This corrupted ring3 register and stack state on return to user mode, producing a reliable General Protection Fault the moment a userspace program performed its first blocking keyboard read. Any ring3 program using tos_read()/tos_readline() on stdin could trigger this deterministically, resulting in denial of service (full system halt via the kernel's own unrecoverable panic handler).
CWE-667, CWE-362, CWE-696
ArtficalAI tAI 4.2