both: TTY input IRQ path blocks on foreground_pgrp

[ryanbreen]

both: TTY input IRQ path blocks on foreground_pgrp

Lock: console TTY foreground_pgrp: Mutex<Option<u64>> (kernel/src/tty/driver.rs:102)

Arch: x86_64, aarch64

IRQ side:
kernel/src/tty/driver.rs:181 input_char_nonblock ->
kernel/src/tty/driver.rs:191 set_foreground_pgrp ->
kernel/src/tty/driver.rs:304 blocking acquisition

The other two IRQ-side touches of this lock (:186, :497) are try_lock with degrade arms; :304 is the outlier.

Thread-side holders:
kernel/src/tty/driver.rs:312 get_foreground_pgrp (unmasked)
kernel/src/tty/driver.rs:465 read in send_signal_to_foreground (unmasked), reached from:
kernel/src/tty/ioctl.rs:192 TIOCGPGRP
kernel/src/tty/ioctl.rs:223 TIOCSPGRP

Note: The thread-side holds are single-statement, making this the narrowest of the UNSAFE-WINDOW findings. It is listed because it is the same defect shape as F3, one line below, and would be repaired in the same diff.

Not measured here. This is a code-path reachability argument with no reproduction.

Related: #812, IRQ-CONTEXT-LOCK-CENSUS-2026-09-05.md section 5.F4