diff --git a/CLAUDE.md b/CLAUDE.md
index 3d749cfd..821a3443 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -16,84 +16,99 @@ docs/planning/   # Numbered phase directories (00-15)
 
 ## Build & Run
 
-### Standard Workflow: Boot Stages Testing
+## 🚨 CRITICAL: QEMU MUST RUN INSIDE DOCKER ONLY 🚨
 
-For normal development, use the boot stages test to verify kernel health:
+**NEVER run QEMU directly on the host.** This is an absolute, inviolable requirement.
 
-```bash
-# Run boot stages test - verifies kernel progresses through all checkpoints
-cargo run -p xtask -- boot-stages
-
-# Build only (no execution)
-cargo build --release --features testing,external_test_bins --bin qemu-uefi
-```
+Running QEMU directly on macOS causes **system-wide instability**:
+- Hypervisor.framework resource leaks when QEMU is killed
+- GPU driver destabilization affecting ALL GPU-accelerated apps
+- Crashes in terminals (Ghostty), browsers (Chrome/Brave), and Electron apps (Slack)
+- Memory pressure cascades from orphaned QEMU processes
 
-The boot stages test (`xtask boot-stages`) monitors serial output for expected markers at each boot phase. Add new stages to `xtask/src/main.rs` when adding new subsystems.
+**The ONLY acceptable ways to run QEMU:**
+1. `./docker/qemu/run-boot-parallel.sh N` - Run N parallel boot tests
+2. `./docker/qemu/run-kthread-parallel.sh N` - Run N parallel kthread tests
+3. `./docker/qemu/run-kthread-test.sh` - Run single kthread test
+4. `./docker/qemu/run-dns-test.sh` - Run DNS resolution test
+5. `./docker/qemu/run-keyboard-test.sh` - Run keyboard input test
+6. `./docker/qemu/run-interactive.sh` - Interactive session with VNC display
 
-### GDB Debugging (For Deep Technical Issues)
-
-Use GDB when you need to understand **why** something is failing, not just **that** it failed. GDB is the right tool when:
-- You need to examine register state or memory at a specific point
-- A panic occurs and you need to inspect the call stack
-- You're debugging timing-sensitive issues that log output can't capture
-- You need to step through code instruction-by-instruction
-
-**Do NOT use GDB** for routine testing or to avoid writing proper boot stage markers. If you find yourself adding debug log statements in a loop, that's a sign you should use GDB instead.
+**For interactive use (framebuffer + keyboard):**
+```bash
+./docker/qemu/run-interactive.sh
+# Then connect with TigerVNC:
+open '/Applications/TigerVNC Viewer 1.15.0.app'
+# Enter: localhost:5900
+```
 
+**PROHIBITED commands (will destabilize the host system):**
 ```bash
-# Start interactive GDB session
+# ❌ NEVER DO THIS:
+cargo run -p xtask -- boot-stages
+cargo run -p xtask -- dns-test
+cargo run --release --bin qemu-uefi
 ./breenix-gdb-chat/scripts/gdb_session.sh start
-./breenix-gdb-chat/scripts/gdb_session.sh cmd "break kernel::kernel_main"
-./breenix-gdb-chat/scripts/gdb_session.sh cmd "continue"
-./breenix-gdb-chat/scripts/gdb_session.sh cmd "info registers"
-./breenix-gdb-chat/scripts/gdb_session.sh cmd "backtrace 10"
-./breenix-gdb-chat/scripts/gdb_session.sh serial
-./breenix-gdb-chat/scripts/gdb_session.sh stop
+qemu-system-x86_64 ...
 ```
 
-### Logs
-All runs are logged to `logs/breenix_YYYYMMDD_HHMMSS.log`
+### One-Time Docker Setup
 
+Before running any tests, build the Docker image:
 ```bash
-# View latest log
-ls -t logs/*.log | head -1 | xargs less
+cd docker/qemu
+docker build -t breenix-qemu .
 ```
 
-### Docker-Based Testing (Recommended for Parallel Execution)
+### Standard Workflow: Docker-Based Testing
 
-For isolated, parallel test execution, use Docker containers. Each container runs its own QEMU instance with no host interference.
+For normal development, use Docker-based boot tests:
 
-**One-time setup - build the Docker image:**
 ```bash
-cd docker/qemu
-docker build -t breenix-qemu .
+# Build the kernel first
+cargo build --release --features testing,external_test_bins --bin qemu-uefi
+
+# Run boot tests in Docker (isolated, safe)
+./docker/qemu/run-boot-parallel.sh 1
+
+# Run multiple parallel tests for stress testing
+./docker/qemu/run-boot-parallel.sh 5
 ```
 
-**Parallel kthread-only tests (fast - focused testing):**
+For kthread-focused testing:
 ```bash
-# Build the kthread_test_only kernel (runs only kthread tests, then exits)
+# Build kthread-only kernel
 cargo build --release --features kthread_test_only --bin qemu-uefi
 
-# Run 10 parallel tests
-./docker/qemu/run-kthread-parallel.sh 10
+# Run kthread tests in Docker
+./docker/qemu/run-kthread-parallel.sh 1
 ```
 
-**Parallel full boot tests:**
+**Why Docker is mandatory:**
+- Complete isolation from host Hypervisor.framework
+- No GPU driver interaction (uses software rendering)
+- Clean container lifecycle - no orphaned processes
+- No risk of destabilizing user's system
+- Containers auto-cleanup with `--rm`
+
+### Logs
+Docker test output goes to `/tmp/breenix_boot_N/` or `/tmp/breenix_kthread_N/`:
 ```bash
-# Build full test kernel
-cargo build --release --features testing,external_test_bins --bin qemu-uefi
+# View kernel log from test 1
+cat /tmp/breenix_boot_1/serial_kernel.txt
 
-# Run 5 parallel full boot tests
-./docker/qemu/run-boot-parallel.sh 5
+# View user output from test 1
+cat /tmp/breenix_boot_1/serial_user.txt
 ```
 
-**Why Docker?**
-- Each container is fully isolated - no lock contention on disk images
-- Can run N tests in parallel without QEMU process conflicts
-- Containers clean up automatically with `--rm`
-- Uses TCG (software emulation) - slower than native but reliable
+### GDB Debugging - DISABLED
+
+GDB debugging requires native QEMU which is prohibited. For debugging:
+1. Add strategic `log::info!()` statements
+2. Run in Docker and examine serial output
+3. Use QEMU's `-d` flags for CPU/interrupt tracing (inside Docker)
 
-**Note:** Docker tests use software CPU emulation (TCG) rather than hardware virtualization, so they run slower than native QEMU with Hypervisor.framework. Use Docker for parallel stress testing; use native QEMU for interactive debugging.
+If you absolutely must use GDB for a critical issue, **ask the user first** and explain why Docker-based debugging is insufficient.
 
 ## Development Workflow
 
@@ -602,36 +617,27 @@ log::debug!("clock_gettime called");  # This changes timing!
 ./breenix-gdb-chat/scripts/gdb_session.sh stop
 ```
 
-## QEMU Process Cleanup - MANDATORY
+## Docker Container Cleanup
 
-**Agents MUST clean up stray QEMU processes.** This is non-negotiable.
+**Docker containers auto-cleanup with `--rm`, but if needed:**
 
-QEMU processes frequently get orphaned during testing, debugging, or when agents are interrupted. These orphaned processes:
-- Hold locks on disk images, preventing new QEMU instances from starting
-- Consume system resources
-- Cause confusing errors like "Failed to get write lock"
+```bash
+# Kill any running breenix-qemu containers
+docker kill $(docker ps -q --filter ancestor=breenix-qemu) 2>/dev/null || true
 
-### Cleanup Requirements
+# Verify no containers running
+docker ps --filter ancestor=breenix-qemu
+```
 
-1. **Before handing control back to the user**: Always run QEMU cleanup
-2. **Before running any QEMU command**: Kill any existing QEMU processes first
-3. **When debugging fails or times out**: Clean up QEMU before reporting results
+### If You See Orphaned Host QEMU Processes
 
-### Cleanup Command
+If you see `qemu-system-x86_64` processes running directly on the host (not in Docker), this means someone violated the Docker-only rule. Clean them up:
 
 ```bash
 pkill -9 qemu-system-x86_64 2>/dev/null; pgrep -l qemu || echo "All QEMU processes killed"
 ```
 
-**CRITICAL: QEMU will ALWAYS hang beyond the bounds of a run.** You MUST kill the previous QEMU before running any test, or it will fail due to disk image lock contention.
-
-### When to Clean Up
-
-- **BEFORE every test run** - This is mandatory, not optional
-- After any `xtask boot-stages` or `xtask interactive` run
-- After GDB debugging sessions
-- When the user reports "cannot acquire lock" errors
-- When handing results back to the user after kernel work
+**Then investigate how they got there** - all QEMU execution must go through Docker.
 
 This is the agent's responsibility - do not wait for the user to ask.
 
diff --git a/Cargo.toml b/Cargo.toml
index 1f50db88..3567a6ae 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -9,6 +9,8 @@ testing = ["kernel/testing"]
 kthread_test_only = ["kernel/kthread_test_only"]  # Run only kthread tests and exit
 kthread_stress_test = ["kernel/kthread_stress_test"]  # Run kthread stress test (100+ kthreads) and exit
 workqueue_test_only = ["kernel/workqueue_test_only"]  # Run only workqueue tests and exit
+dns_test_only = ["kernel/dns_test_only"]  # Run only DNS test and exit (fast network debugging)
+blocking_recv_test = ["kernel/blocking_recv_test"]  # Run only blocking recvfrom test and exit
 test_divide_by_zero = ["kernel/test_divide_by_zero"]
 test_invalid_opcode = ["kernel/test_invalid_opcode"]
 test_page_fault = ["kernel/test_page_fault"]
diff --git a/docker/qemu/Dockerfile b/docker/qemu/Dockerfile
index aa7417f2..a45cf2e4 100644
--- a/docker/qemu/Dockerfile
+++ b/docker/qemu/Dockerfile
@@ -1,13 +1,19 @@
 # Dockerfile for running Breenix tests in isolated QEMU
 # Includes tools for keyboard input testing via QEMU monitor
+# Supports X11 and VNC display modes for interactive use
 
 FROM ubuntu:24.04
 
-# Install QEMU and OVMF
+# Install QEMU with display support and OVMF
 RUN apt-get update && apt-get install -y \
     qemu-system-x86 \
     ovmf \
     expect \
+    # X11 and SDL support for graphical display
+    libsdl2-2.0-0 \
+    libgtk-3-0 \
+    libvte-2.91-0 \
+    x11-apps \
     && rm -rf /var/lib/apt/lists/*
 
 # Create working directory
diff --git a/docker/qemu/run-blocking-recv-test.sh b/docker/qemu/run-blocking-recv-test.sh
new file mode 100755
index 00000000..a945d94c
--- /dev/null
+++ b/docker/qemu/run-blocking-recv-test.sh
@@ -0,0 +1,129 @@
+#!/bin/bash
+# Run blocking recvfrom test in isolated Docker container
+# Usage: ./run-blocking-recv-test.sh
+#
+# This script runs the blocking_recv_test kernel build in Docker,
+# then sends a UDP packet to wake the blocking recvfrom().
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+BREENIX_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+# Build Docker image if needed
+IMAGE_NAME="breenix-qemu"
+if ! docker image inspect "$IMAGE_NAME" &>/dev/null; then
+    echo "Building Docker image..."
+    docker build -t "$IMAGE_NAME" "$SCRIPT_DIR"
+fi
+
+echo "Building blocking_recv_test kernel..."
+cargo build --release --features blocking_recv_test --bin qemu-uefi
+
+# Check for blocking_recv_test kernel build
+UEFI_IMG=$(ls -t "$BREENIX_ROOT/target/release/build/breenix-"*/out/breenix-uefi.img 2>/dev/null | head -1)
+if [ -z "$UEFI_IMG" ]; then
+    echo "Error: UEFI image not found."
+    exit 1
+fi
+
+if [ ! -f "$BREENIX_ROOT/target/test_binaries.img" ]; then
+    echo "Error: test_binaries.img not found. Build the test disk first."
+    exit 1
+fi
+
+# Create output directory
+OUTPUT_DIR=$(mktemp -d)
+trap "rm -rf $OUTPUT_DIR" EXIT
+
+# Create empty output files
+touch "$OUTPUT_DIR/serial_kernel.txt"
+touch "$OUTPUT_DIR/serial_user.txt"
+
+echo "Running blocking recvfrom test in Docker container..."
+echo "  UEFI image: $UEFI_IMG"
+echo "  Output dir: $OUTPUT_DIR"
+echo ""
+
+# Copy OVMF files to writable location
+cp "$BREENIX_ROOT/target/ovmf/x64/code.fd" "$OUTPUT_DIR/OVMF_CODE.fd"
+cp "$BREENIX_ROOT/target/ovmf/x64/vars.fd" "$OUTPUT_DIR/OVMF_VARS.fd"
+
+# Run QEMU inside Docker
+# - Uses SLIRP networking (user mode) with UDP forward from host port 55556
+timeout 120 docker run --rm \
+    -p 55556:55556/udp \
+    -v "$UEFI_IMG:/breenix/breenix-uefi.img:ro" \
+    -v "$BREENIX_ROOT/target/test_binaries.img:/breenix/test_binaries.img:ro" \
+    -v "$BREENIX_ROOT/target/ext2.img:/breenix/ext2.img:ro" \
+    -v "$OUTPUT_DIR:/output" \
+    "$IMAGE_NAME" \
+    qemu-system-x86_64 \
+        -pflash /output/OVMF_CODE.fd \
+        -pflash /output/OVMF_VARS.fd \
+        -drive if=none,id=hd,format=raw,media=disk,readonly=on,file=/breenix/breenix-uefi.img \
+        -device virtio-blk-pci,drive=hd,bootindex=0,disable-modern=on,disable-legacy=off \
+        -drive if=none,id=testdisk,format=raw,readonly=on,file=/breenix/test_binaries.img \
+        -device virtio-blk-pci,drive=testdisk,disable-modern=on,disable-legacy=off \
+        -drive if=none,id=ext2disk,format=raw,readonly=on,file=/breenix/ext2.img \
+        -device virtio-blk-pci,drive=ext2disk,disable-modern=on,disable-legacy=off \
+        -machine pc,accel=tcg \
+        -cpu qemu64 \
+        -smp 1 \
+        -m 512 \
+        -display none \
+        -boot strict=on \
+        -no-reboot \
+        -no-shutdown \
+        -monitor none \
+        -device isa-debug-exit,iobase=0xf4,iosize=0x04 \
+        -netdev user,id=net0,hostfwd=udp::55556-:55556 \
+        -device e1000,netdev=net0,mac=52:54:00:12:34:56 \
+        -serial file:/output/serial_user.txt \
+        -serial file:/output/serial_kernel.txt \
+    &
+
+QEMU_PID=$!
+
+echo "Waiting for blocking recvfrom test..."
+TIMEOUT=90
+ELAPSED=0
+SENT_PACKET=0
+
+while [ $ELAPSED -lt $TIMEOUT ]; do
+    sleep 1
+    ELAPSED=$((ELAPSED + 1))
+
+    if [ -f "$OUTPUT_DIR/serial_user.txt" ]; then
+        USER_OUTPUT=$(cat "$OUTPUT_DIR/serial_user.txt" 2>/dev/null)
+
+        if [ $SENT_PACKET -eq 0 ] && echo "$USER_OUTPUT" | grep -q "BLOCKING_RECV_TEST: waiting for packet..."; then
+            SENT_PACKET=1
+            echo "Blocking recvfrom waiting; sending UDP packet..."
+            echo "wakeup" | nc -u -w1 localhost 55556 || true
+        fi
+
+        if echo "$USER_OUTPUT" | grep -q "BLOCKING_RECV_TEST: PASS"; then
+            echo ""
+            echo "========================================="
+            echo "BLOCKING RECV TEST: PASS"
+            echo "========================================="
+            docker kill $(docker ps -q --filter ancestor="$IMAGE_NAME") 2>/dev/null || true
+            exit 0
+        fi
+    fi
+done
+
+echo ""
+echo "========================================="
+echo "BLOCKING RECV TEST: TIMEOUT"
+echo "========================================="
+echo ""
+echo "User output (COM1):"
+cat "$OUTPUT_DIR/serial_user.txt" 2>/dev/null | grep -E "BLOCKING_RECV_TEST" || echo "(no blocking recv output)"
+echo ""
+echo "Last 20 lines of kernel output (COM2):"
+tail -20 "$OUTPUT_DIR/serial_kernel.txt" 2>/dev/null || echo "(no output)"
+
+docker kill $(docker ps -q --filter ancestor="$IMAGE_NAME") 2>/dev/null || true
+exit 1
diff --git a/docker/qemu/run-dns-test.sh b/docker/qemu/run-dns-test.sh
new file mode 100755
index 00000000..aec6f3e0
--- /dev/null
+++ b/docker/qemu/run-dns-test.sh
@@ -0,0 +1,155 @@
+#!/bin/bash
+# Run DNS test in isolated Docker container
+# Usage: ./run-dns-test.sh
+#
+# This script runs the dns_test_only kernel build in Docker,
+# isolating QEMU from the host system to prevent crashes.
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+BREENIX_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+# Build Docker image if needed
+IMAGE_NAME="breenix-qemu"
+if ! docker image inspect "$IMAGE_NAME" &>/dev/null; then
+    echo "Building Docker image..."
+    docker build -t "$IMAGE_NAME" "$SCRIPT_DIR"
+fi
+
+# Check for dns_test_only kernel build
+UEFI_IMG=$(ls -t "$BREENIX_ROOT/target/release/build/breenix-"*/out/breenix-uefi.img 2>/dev/null | head -1)
+if [ -z "$UEFI_IMG" ]; then
+    echo "Error: UEFI image not found. Build with:"
+    echo "  cargo build --release --features dns_test_only --bin qemu-uefi"
+    exit 1
+fi
+
+# Create output directory
+OUTPUT_DIR=$(mktemp -d)
+trap "rm -rf $OUTPUT_DIR" EXIT
+
+# Create empty output files
+touch "$OUTPUT_DIR/serial_kernel.txt"
+touch "$OUTPUT_DIR/serial_user.txt"
+
+echo "Running DNS test in Docker container..."
+echo "  UEFI image: $UEFI_IMG"
+echo "  Output dir: $OUTPUT_DIR"
+echo ""
+
+# Copy OVMF files to writable location
+cp "$BREENIX_ROOT/target/ovmf/x64/code.fd" "$OUTPUT_DIR/OVMF_CODE.fd"
+cp "$BREENIX_ROOT/target/ovmf/x64/vars.fd" "$OUTPUT_DIR/OVMF_VARS.fd"
+
+# Run QEMU inside Docker
+# - Uses SLIRP networking (user mode) which provides DNS at 10.0.2.3
+# - TCG acceleration (software emulation) - slower but isolated
+timeout 120 docker run --rm \
+    -v "$UEFI_IMG:/breenix/breenix-uefi.img:ro" \
+    -v "$BREENIX_ROOT/target/test_binaries.img:/breenix/test_binaries.img:ro" \
+    -v "$BREENIX_ROOT/target/ext2.img:/breenix/ext2.img:ro" \
+    -v "$OUTPUT_DIR:/output" \
+    "$IMAGE_NAME" \
+    qemu-system-x86_64 \
+        -pflash /output/OVMF_CODE.fd \
+        -pflash /output/OVMF_VARS.fd \
+        -drive if=none,id=hd,format=raw,media=disk,readonly=on,file=/breenix/breenix-uefi.img \
+        -device virtio-blk-pci,drive=hd,bootindex=0,disable-modern=on,disable-legacy=off \
+        -drive if=none,id=testdisk,format=raw,readonly=on,file=/breenix/test_binaries.img \
+        -device virtio-blk-pci,drive=testdisk,disable-modern=on,disable-legacy=off \
+        -drive if=none,id=ext2disk,format=raw,readonly=on,file=/breenix/ext2.img \
+        -device virtio-blk-pci,drive=ext2disk,disable-modern=on,disable-legacy=off \
+        -machine pc,accel=tcg \
+        -cpu qemu64 \
+        -smp 1 \
+        -m 512 \
+        -display none \
+        -boot strict=on \
+        -no-reboot \
+        -no-shutdown \
+        -monitor none \
+        -device isa-debug-exit,iobase=0xf4,iosize=0x04 \
+        -netdev user,id=net0 \
+        -device e1000,netdev=net0,mac=52:54:00:12:34:56 \
+        -serial file:/output/serial_user.txt \
+        -serial file:/output/serial_kernel.txt \
+    &
+
+QEMU_PID=$!
+
+# Wait for DNS test markers
+echo "Waiting for DNS test completion..."
+TIMEOUT=90
+ELAPSED=0
+
+# DNS test stages to check
+STAGES_PASSED=0
+TOTAL_STAGES=6
+
+while [ $ELAPSED -lt $TIMEOUT ]; do
+    sleep 1
+    ELAPSED=$((ELAPSED + 1))
+
+    if [ -f "$OUTPUT_DIR/serial_user.txt" ]; then
+        USER_OUTPUT=$(cat "$OUTPUT_DIR/serial_user.txt" 2>/dev/null)
+
+        # Check each stage
+        CURRENT_STAGES=0
+
+        if echo "$USER_OUTPUT" | grep -q "DNS Test: Starting"; then
+            CURRENT_STAGES=$((CURRENT_STAGES + 1))
+        fi
+
+        if echo "$USER_OUTPUT" | grep -q "DNS_TEST: google_resolve OK"; then
+            CURRENT_STAGES=$((CURRENT_STAGES + 1))
+        fi
+
+        if echo "$USER_OUTPUT" | grep -q "DNS_TEST: example_resolve OK"; then
+            CURRENT_STAGES=$((CURRENT_STAGES + 1))
+        fi
+
+        if echo "$USER_OUTPUT" | grep -q "DNS_TEST: nxdomain OK"; then
+            CURRENT_STAGES=$((CURRENT_STAGES + 1))
+        fi
+
+        if echo "$USER_OUTPUT" | grep -q "DNS_TEST: empty_hostname OK"; then
+            CURRENT_STAGES=$((CURRENT_STAGES + 1))
+        fi
+
+        if echo "$USER_OUTPUT" | grep -q "DNS Test: All tests passed"; then
+            CURRENT_STAGES=$((CURRENT_STAGES + 1))
+        fi
+
+        # Report progress if changed
+        if [ $CURRENT_STAGES -gt $STAGES_PASSED ]; then
+            STAGES_PASSED=$CURRENT_STAGES
+            echo "  Progress: $STAGES_PASSED/$TOTAL_STAGES stages passed"
+        fi
+
+        # All tests passed
+        if [ $STAGES_PASSED -eq $TOTAL_STAGES ]; then
+            echo ""
+            echo "========================================="
+            echo "DNS TEST: ALL $TOTAL_STAGES STAGES PASSED"
+            echo "========================================="
+            docker kill $(docker ps -q --filter ancestor="$IMAGE_NAME") 2>/dev/null || true
+            exit 0
+        fi
+    fi
+done
+
+echo ""
+echo "========================================="
+echo "DNS TEST: TIMEOUT ($STAGES_PASSED/$TOTAL_STAGES passed)"
+echo "========================================="
+echo ""
+echo "User output (COM1):"
+cat "$OUTPUT_DIR/serial_user.txt" 2>/dev/null | grep -E "(DNS|resolve)" || echo "(no DNS output)"
+echo ""
+echo "Last 20 lines of kernel output (COM2):"
+tail -20 "$OUTPUT_DIR/serial_kernel.txt" 2>/dev/null || echo "(no output)"
+
+# Kill any remaining container
+docker kill $(docker ps -q --filter ancestor="$IMAGE_NAME") 2>/dev/null || true
+exit 1
diff --git a/docker/qemu/run-interactive.sh b/docker/qemu/run-interactive.sh
new file mode 100755
index 00000000..d36c5130
--- /dev/null
+++ b/docker/qemu/run-interactive.sh
@@ -0,0 +1,99 @@
+#!/bin/bash
+# Run QEMU interactively in Docker with VNC display
+# Usage: ./run-interactive.sh
+#
+# Automatically opens TigerVNC connected to the QEMU display.
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+BREENIX_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+# Build Docker image if needed
+IMAGE_NAME="breenix-qemu"
+if ! docker image inspect "$IMAGE_NAME" &>/dev/null; then
+    echo "Building Docker image..."
+    docker build -t "$IMAGE_NAME" "$SCRIPT_DIR"
+fi
+
+# Find the UEFI image
+UEFI_IMG=$(ls -t "$BREENIX_ROOT/target/release/build/breenix-"*/out/breenix-uefi.img 2>/dev/null | head -1)
+if [ -z "$UEFI_IMG" ]; then
+    echo "Error: UEFI image not found. Build with:"
+    echo "  cargo build --release --features interactive --bin qemu-uefi"
+    exit 1
+fi
+
+# Create output directory
+OUTPUT_DIR=$(mktemp -d)
+
+# Copy OVMF files
+cp "$BREENIX_ROOT/target/ovmf/x64/code.fd" "$OUTPUT_DIR/OVMF_CODE.fd"
+cp "$BREENIX_ROOT/target/ovmf/x64/vars.fd" "$OUTPUT_DIR/OVMF_VARS.fd"
+
+# Create empty serial output files
+touch "$OUTPUT_DIR/serial_user.txt"
+touch "$OUTPUT_DIR/serial_kernel.txt"
+
+echo ""
+echo "========================================="
+echo "Starting QEMU with VNC display"
+echo "========================================="
+echo "Output: $OUTPUT_DIR"
+echo ""
+echo "Press Ctrl+C to stop"
+echo ""
+
+# Run QEMU with VNC in background
+docker run --rm \
+    -p 5900:5900 \
+    -v "$UEFI_IMG:/breenix/breenix-uefi.img:ro" \
+    -v "$BREENIX_ROOT/target/test_binaries.img:/breenix/test_binaries.img:ro" \
+    -v "$BREENIX_ROOT/target/ext2.img:/breenix/ext2.img:ro" \
+    -v "$OUTPUT_DIR:/output" \
+    "$IMAGE_NAME" \
+    qemu-system-x86_64 \
+        -pflash /output/OVMF_CODE.fd \
+        -pflash /output/OVMF_VARS.fd \
+        -drive if=none,id=hd,format=raw,media=disk,readonly=on,file=/breenix/breenix-uefi.img \
+        -device virtio-blk-pci,drive=hd,bootindex=0,disable-modern=on,disable-legacy=off \
+        -drive if=none,id=testdisk,format=raw,readonly=on,file=/breenix/test_binaries.img \
+        -device virtio-blk-pci,drive=testdisk,disable-modern=on,disable-legacy=off \
+        -drive if=none,id=ext2disk,format=raw,readonly=on,file=/breenix/ext2.img \
+        -device virtio-blk-pci,drive=ext2disk,disable-modern=on,disable-legacy=off \
+        -machine pc,accel=tcg \
+        -cpu qemu64 \
+        -smp 1 \
+        -m 512 \
+        -device virtio-vga \
+        -vnc :0 \
+        -k en-us \
+        -no-reboot \
+        -device isa-debug-exit,iobase=0xf4,iosize=0x04 \
+        -netdev user,id=net0 \
+        -device e1000,netdev=net0,mac=52:54:00:12:34:56 \
+        -serial file:/output/serial_user.txt \
+        -serial file:/output/serial_kernel.txt \
+    &
+
+DOCKER_PID=$!
+
+# Wait for VNC to be ready
+echo "Waiting for VNC server..."
+sleep 3
+
+# Auto-open TigerVNC
+echo "Opening TigerVNC..."
+open "/Applications/TigerVNC Viewer 1.15.0.app" --args localhost:5900
+
+# Wait for docker to finish
+wait $DOCKER_PID 2>/dev/null
+
+echo ""
+echo "========================================="
+echo "QEMU stopped"
+echo "========================================="
+echo ""
+echo "Serial output saved to:"
+echo "  User (COM1):   $OUTPUT_DIR/serial_user.txt"
+echo "  Kernel (COM2): $OUTPUT_DIR/serial_kernel.txt"
diff --git a/docker/qemu/run-keyboard-test.sh b/docker/qemu/run-keyboard-test.sh
new file mode 100755
index 00000000..76ec254c
--- /dev/null
+++ b/docker/qemu/run-keyboard-test.sh
@@ -0,0 +1,151 @@
+#!/bin/bash
+# Test keyboard input in QEMU using QEMU monitor via TCP socket
+#
+# Usage: ./run-keyboard-test.sh
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+cd "$PROJECT_ROOT"
+
+# Build the kernel first - use testing feature (not interactive which requires test disk)
+echo "Building kernel..."
+cargo build --release --features testing --bin qemu-uefi 2>&1 | grep -E "Compiling|Finished|error" || true
+
+# Get the UEFI image path
+UEFI_IMG=$(find target/release/build -name "breenix-uefi.img" 2>/dev/null | head -1)
+if [ -z "$UEFI_IMG" ]; then
+    echo "ERROR: Could not find breenix-uefi.img"
+    exit 1
+fi
+echo "Using UEFI image: $UEFI_IMG"
+
+# Get OVMF path
+OVMF_CODE=$(find target -name "OVMF_CODE.fd" 2>/dev/null | head -1)
+if [ -z "$OVMF_CODE" ]; then
+    OVMF_CODE="target/ovmf/x64/code.fd"
+fi
+echo "Using OVMF: $OVMF_CODE"
+
+# Create output directory
+mkdir -p target/keyboard-test
+SERIAL1_OUTPUT="$PROJECT_ROOT/target/keyboard-test/serial1_output.txt"
+SERIAL2_OUTPUT="$PROJECT_ROOT/target/keyboard-test/serial2_output.txt"
+rm -f "$SERIAL1_OUTPUT" "$SERIAL2_OUTPUT"
+
+echo "Starting QEMU with monitor on TCP port 4444..."
+echo "Capturing both COM1 and COM2 serial ports..."
+
+# Start QEMU in background with monitor on TCP socket
+# Capture BOTH serial ports (COM1 = user output, COM2 = boot stages)
+qemu-system-x86_64 \
+    -drive if=pflash,format=raw,readonly=on,file="$OVMF_CODE" \
+    -drive format=raw,file="$UEFI_IMG" \
+    -m 512M \
+    -serial file:"$SERIAL1_OUTPUT" \
+    -serial file:"$SERIAL2_OUTPUT" \
+    -display none \
+    -device VGA \
+    -monitor tcp:127.0.0.1:4444,server,nowait \
+    &
+QEMU_PID=$!
+
+echo "QEMU started with PID $QEMU_PID"
+
+# Wait for kernel to boot and enable interrupts
+# Need enough time for kernel init but before it panics from missing test disk
+echo "Waiting 8 seconds for kernel to initialize and enable interrupts..."
+sleep 8
+
+# Check if serial output is being generated
+echo "Serial output status:"
+if [ -f "$SERIAL1_OUTPUT" ]; then
+    SIZE1=$(wc -c < "$SERIAL1_OUTPUT")
+    echo "  COM1 (user output): $SIZE1 bytes"
+else
+    echo "  COM1: No file yet"
+fi
+if [ -f "$SERIAL2_OUTPUT" ]; then
+    SIZE2=$(wc -c < "$SERIAL2_OUTPUT")
+    echo "  COM2 (boot stages): $SIZE2 bytes"
+else
+    echo "  COM2: No file yet"
+fi
+
+# Send keystrokes via QEMU monitor
+echo "Sending keystrokes via monitor..."
+
+# Function to send monitor command
+send_key() {
+    echo "sendkey $1" | nc -q 1 127.0.0.1 4444 2>/dev/null || echo "sendkey $1" | nc 127.0.0.1 4444 2>/dev/null || true
+    sleep 0.5
+}
+
+# Send keys: a, b, c, 1, 2, 3
+for key in a b c 1 2 3; do
+    echo "  Sending key: $key"
+    send_key "$key"
+done
+
+# Send Enter
+echo "  Sending key: ret"
+send_key "ret"
+sleep 0.5
+send_key "ret"
+sleep 3
+
+echo "Done sending keystrokes"
+
+# Show final serial output sizes
+echo "Final serial output status:"
+if [ -f "$SERIAL1_OUTPUT" ]; then
+    SIZE1=$(wc -c < "$SERIAL1_OUTPUT")
+    echo "  COM1 (user output): $SIZE1 bytes"
+fi
+if [ -f "$SERIAL2_OUTPUT" ]; then
+    SIZE2=$(wc -c < "$SERIAL2_OUTPUT")
+    echo "  COM2 (boot stages): $SIZE2 bytes"
+fi
+
+# Quit QEMU
+echo "quit" | nc -q 1 127.0.0.1 4444 2>/dev/null || echo "quit" | nc 127.0.0.1 4444 2>/dev/null || true
+sleep 1
+kill $QEMU_PID 2>/dev/null || true
+
+# Check results - look in BOTH serial outputs
+echo ""
+echo "=== KEYBOARD TEST RESULTS ==="
+
+# Combine both serial outputs for searching
+cat "$SERIAL1_OUTPUT" "$SERIAL2_OUTPUT" 2>/dev/null > /tmp/combined_serial.txt
+
+echo "Looking for KEY:XX patterns in both serial outputs..."
+KEY_COUNT=$(grep -c "KEY:" /tmp/combined_serial.txt 2>/dev/null || echo "0")
+if [ "$KEY_COUNT" -gt 0 ]; then
+    echo "SUCCESS: Found $KEY_COUNT keyboard interrupt markers!"
+    echo ""
+    echo "Key patterns found:"
+    grep -o "KEY:[0-9A-Fa-f][0-9A-Fa-f]" /tmp/combined_serial.txt | sort | uniq -c
+else
+    echo "FAILURE: No KEY:XX patterns found"
+    echo ""
+    echo "=== COM1 (user output) - checking for keyboard/PIC messages ==="
+    if [ -f "$SERIAL1_OUTPUT" ]; then
+        grep -i "PIC\|keyboard\|KEY" "$SERIAL1_OUTPUT" | head -10 || echo "No PIC/keyboard messages in COM1"
+    fi
+    echo ""
+    echo "=== COM2 (boot stages) - checking for keyboard/PIC messages ==="
+    if [ -f "$SERIAL2_OUTPUT" ]; then
+        grep -i "PIC\|keyboard\|KEY" "$SERIAL2_OUTPUT" | head -10 || echo "No PIC/keyboard messages in COM2"
+    fi
+    echo ""
+    echo "=== Last 20 lines of COM1 ==="
+    tail -20 "$SERIAL1_OUTPUT" 2>/dev/null || echo "No COM1 output"
+    echo ""
+    echo "=== Last 20 lines of COM2 ==="
+    tail -20 "$SERIAL2_OUTPUT" 2>/dev/null || echo "No COM2 output"
+fi
+
+rm -f /tmp/combined_serial.txt
diff --git a/kernel/Cargo.toml b/kernel/Cargo.toml
index ca074c1d..0f5ed202 100644
--- a/kernel/Cargo.toml
+++ b/kernel/Cargo.toml
@@ -21,6 +21,8 @@ testing = []
 kthread_test_only = ["testing"]  # Run only kthread tests and exit
 kthread_stress_test = ["testing"]  # Run kthread stress test (100+ kthreads) and exit
 workqueue_test_only = ["testing"]  # Run only workqueue tests and exit
+dns_test_only = ["testing", "external_test_bins"]  # Run only DNS test and exit (fast network debugging)
+blocking_recv_test = ["testing", "external_test_bins"]  # Run only blocking recvfrom test and exit
 test_divide_by_zero = []
 test_invalid_opcode = []
 test_page_fault = []
diff --git a/kernel/src/clock_gettime_test.rs b/kernel/src/clock_gettime_test.rs
index c914bba5..3843cda7 100644
--- a/kernel/src/clock_gettime_test.rs
+++ b/kernel/src/clock_gettime_test.rs
@@ -32,6 +32,8 @@ use crate::syscall::ErrorCode;
 use crate::time::tsc;
 use crate::time::DateTime;
 
+/// In-kernel test for clock_gettime - only called in certain build configurations.
+#[allow(dead_code)]
 pub fn test_clock_gettime() {
     log::info!("=== CLOCK_GETTIME TEST ===");
 
diff --git a/kernel/src/drivers/e1000/mod.rs b/kernel/src/drivers/e1000/mod.rs
index a335d6c8..40a88f4c 100644
--- a/kernel/src/drivers/e1000/mod.rs
+++ b/kernel/src/drivers/e1000/mod.rs
@@ -651,7 +651,8 @@ pub fn handle_interrupt() {
         driver.handle_interrupt();
     }
 
-    // Process any received packets
-    // Note: This is done outside the driver lock to avoid holding it too long
-    crate::net::process_rx();
+    // Defer RX processing to softirq context
+    // This allows packet processing to run with interrupts enabled,
+    // preventing interrupt latency issues from long packet processing
+    crate::task::softirqd::raise_softirq(crate::task::softirqd::SoftirqType::NetRx);
 }
diff --git a/kernel/src/drivers/mod.rs b/kernel/src/drivers/mod.rs
index d4343cd2..843c858c 100644
--- a/kernel/src/drivers/mod.rs
+++ b/kernel/src/drivers/mod.rs
@@ -42,7 +42,10 @@ pub fn init() -> usize {
     match e1000::init() {
         Ok(()) => {
             log::info!("E1000 network driver initialized successfully");
-            // TODO: Enable E1000 IRQ when interrupt handler is wired up
+
+            // Enable E1000 IRQ now that driver is initialized
+            // E1000 uses IRQ 10 in QEMU's PCI configuration
+            crate::interrupts::enable_irq10();
         }
         Err(e) => {
             log::warn!("E1000 network driver initialization failed: {}", e);
diff --git a/kernel/src/interrupts.rs b/kernel/src/interrupts.rs
index 7f1bed6c..52ce0b05 100644
--- a/kernel/src/interrupts.rs
+++ b/kernel/src/interrupts.rs
@@ -30,7 +30,9 @@ pub enum InterruptIndex {
     Keyboard,
     // Skip COM2 (IRQ3)
     Serial = PIC_1_OFFSET + 4, // COM1 is IRQ4
-    // IRQ 11 is shared by VirtIO block and E1000 network devices (on PIC2)
+    // IRQ 10 is used by E1000 network and some VirtIO devices (on PIC2)
+    Irq10 = PIC_2_OFFSET + 2, // IRQ 10 = 40 + 2 = 42
+    // IRQ 11 is used by some VirtIO block devices (on PIC2)
     Irq11 = PIC_2_OFFSET + 3, // IRQ 11 = 40 + 3 = 43
 }
 
@@ -50,6 +52,7 @@ impl InterruptIndex {
         self as u8
     }
 
+    #[allow(dead_code)] // Part of public API
     pub fn as_usize(self) -> usize {
         usize::from(self.as_u8())
     }
@@ -130,6 +133,7 @@ pub fn init_idt() {
         }
         idt[InterruptIndex::Keyboard.as_u8()].set_handler_fn(keyboard_interrupt_handler);
         idt[InterruptIndex::Serial.as_u8()].set_handler_fn(serial_interrupt_handler);
+        idt[InterruptIndex::Irq10.as_u8()].set_handler_fn(irq10_handler);
         idt[InterruptIndex::Irq11.as_u8()].set_handler_fn(irq11_handler);
 
         // System call handler (INT 0x80)
@@ -177,6 +181,7 @@ pub fn init_idt() {
             if i != InterruptIndex::Timer.as_u8()
                 && i != InterruptIndex::Keyboard.as_u8()
                 && i != InterruptIndex::Serial.as_u8()
+                && i != InterruptIndex::Irq10.as_u8()
                 && i != InterruptIndex::Irq11.as_u8()
                 && i != SYSCALL_INTERRUPT_ID
             {
@@ -229,7 +234,30 @@ pub fn init_pic() {
     }
 }
 
-/// Enable IRQ 11 (shared by VirtIO block and E1000 network)
+/// Enable IRQ 10 (used by E1000 network and some VirtIO devices)
+///
+/// IMPORTANT: Only call this AFTER devices using IRQ 10 have been initialized.
+/// Calling earlier will cause hangs due to interrupt handler accessing
+/// uninitialized driver state.
+pub fn enable_irq10() {
+    unsafe {
+        use x86_64::instructions::port::Port;
+
+        // Unmask IRQ 10 (bit 2 on PIC2)
+        let mut port2: Port<u8> = Port::new(0xA1); // PIC2 data port
+        let mask2 = port2.read() & !0b00000100; // Clear bit 2 (IRQ 10 = 8 + 2)
+        port2.write(mask2);
+
+        // Ensure cascade (IRQ2) is unmasked on PIC1
+        let mut port1: Port<u8> = Port::new(0x21); // PIC1 data port
+        let mask1_cascade = port1.read() & !0b00000100; // Clear bit 2 (cascade)
+        port1.write(mask1_cascade);
+
+        log::debug!("IRQ 10 enabled (E1000)");
+    }
+}
+
+/// Enable IRQ 11 (used by some VirtIO block devices)
 ///
 /// IMPORTANT: Only call this AFTER devices using IRQ 11 have been initialized.
 /// Calling earlier will cause hangs due to interrupt handler accessing
@@ -504,7 +532,28 @@ extern "x86-interrupt" fn serial_interrupt_handler(_stack_frame: InterruptStackF
 }
 
 
-/// Shared IRQ 11 handler for VirtIO block and E1000 network devices
+/// IRQ 10 handler for E1000 network device
+///
+/// CRITICAL: This handler must be extremely fast. No logging, no allocations.
+/// Target: <1000 cycles total.
+extern "x86-interrupt" fn irq10_handler(_stack_frame: InterruptStackFrame) {
+    // Enter hardware IRQ context
+    crate::per_cpu::irq_enter();
+
+    // Dispatch to E1000 network if initialized
+    crate::drivers::e1000::handle_interrupt();
+
+    // Send EOI to both PICs (IRQ 10 is on PIC2)
+    unsafe {
+        PICS.lock()
+            .notify_end_of_interrupt(InterruptIndex::Irq10.as_u8());
+    }
+
+    // Exit hardware IRQ context
+    crate::per_cpu::irq_exit();
+}
+
+/// IRQ 11 handler for VirtIO block devices
 ///
 /// CRITICAL: This handler must be extremely fast. No logging, no allocations.
 /// Target: <1000 cycles total.
@@ -517,7 +566,7 @@ extern "x86-interrupt" fn irq11_handler(_stack_frame: InterruptStackFrame) {
         device.handle_interrupt();
     }
 
-    // Dispatch to E1000 network if initialized
+    // Also check E1000 on IRQ 11 - some QEMU configurations route E1000 here
     crate::drivers::e1000::handle_interrupt();
 
     // Send EOI to both PICs (IRQ 11 is on PIC2)
@@ -1510,6 +1559,7 @@ pub fn get_idt_info() -> (u64, u16) {
 
 /// Validate that the IDT entry for the timer interrupt is properly configured
 /// Returns (is_valid, handler_address, description)
+#[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
 pub fn validate_timer_idt_entry() -> (bool, u64, &'static str) {
     // Read the IDT entry for vector 32 (timer interrupt)
     if let Some(idt) = IDT.get() {
@@ -1555,12 +1605,14 @@ pub fn validate_timer_idt_entry() -> (bool, u64, &'static str) {
 }
 
 /// Check if interrupts are currently enabled
+#[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
 pub fn are_interrupts_enabled() -> bool {
     x86_64::instructions::interrupts::are_enabled()
 }
 
 /// Validate that the PIC has IRQ0 (timer) unmasked
 /// Returns (is_unmasked, mask_value, description)
+#[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
 pub fn validate_pic_irq0_unmasked() -> (bool, u8, &'static str) {
     unsafe {
         use x86_64::instructions::port::Port;
diff --git a/kernel/src/interrupts/context_switch.rs b/kernel/src/interrupts/context_switch.rs
index a2b157bb..e6e3a9da 100644
--- a/kernel/src/interrupts/context_switch.rs
+++ b/kernel/src/interrupts/context_switch.rs
@@ -25,6 +25,19 @@ pub fn raw_serial_char(c: u8) {
     }
 }
 
+/// Raw serial string output - no locks, no allocations.
+/// Use for boot markers in context switch path where locking would deadlock.
+#[inline(always)]
+fn raw_serial_str(s: &str) {
+    unsafe {
+        use x86_64::instructions::port::Port;
+        let mut port: Port<u8> = Port::new(0x3F8);
+        for byte in s.bytes() {
+            port.write(byte);
+        }
+    }
+}
+
 // REMOVED: NEXT_PAGE_TABLE is no longer needed since CR3 switching happens
 // immediately during context switch, not deferred to interrupt return
 
@@ -49,6 +62,18 @@ pub extern "C" fn check_need_resched_and_switch(
     // only when switching away.
     let from_userspace = (interrupt_frame.code_segment.0 & 3) == 3;
 
+    // CRITICAL: Check if preemption is enabled before attempting context switch.
+    // Syscalls call preempt_disable() at entry, so if preempt_count > 0, we must NOT
+    // switch away. The bits 0-27 hold the actual count, bit 28 is PREEMPT_ACTIVE.
+    let preempt_count = crate::per_cpu::preempt_count();
+    let preempt_count_value = preempt_count & 0x0FFFFFFF; // Mask out PREEMPT_ACTIVE bit
+    if preempt_count_value > 0 && !from_userspace {
+        // Preemption disabled while in kernel - don't context switch.
+        // The thread is executing a syscall or other non-preemptible kernel code.
+        // Leave need_resched set so we try again after preempt_enable().
+        return;
+    }
+
     // CRITICAL FIX: Check PREEMPT_ACTIVE early, BEFORE calling schedule().
     // PREEMPT_ACTIVE (bit 28) is set in syscall/entry.asm during syscall return
     // to protect the register restoration sequence. If set, we're in the middle
@@ -63,20 +88,17 @@ pub extern "C" fn check_need_resched_and_switch(
     let preempt_count = crate::per_cpu::preempt_count();
     let preempt_active = (preempt_count & 0x10000000) != 0; // Bit 28
 
-    if from_userspace && preempt_active {
-        // We're in syscall return path - the registers in saved_regs are KERNEL values!
-        // Do NOT attempt a context switch. Re-set need_resched for next opportunity.
-        static EARLY_PREEMPT_ACTIVE_COUNT: core::sync::atomic::AtomicU64 =
-            core::sync::atomic::AtomicU64::new(0);
-        let count = EARLY_PREEMPT_ACTIVE_COUNT.fetch_add(1, core::sync::atomic::Ordering::Relaxed);
-        if count < 10 {
-            log::info!(
-                "check_need_resched_and_switch: PREEMPT_ACTIVE set (count={:#x}), deferring context switch",
-                preempt_count
-            );
-        }
-        // Don't clear need_resched - it will be checked on the next timer interrupt
-        // after the syscall return completes
+    if preempt_active {
+        // PREEMPT_ACTIVE is set during syscall return while registers are being restored.
+        // We must NOT context switch during this critical window, regardless of whether
+        // the interrupt frame shows userspace or kernel CS.
+        //
+        // Previously this only checked `from_userspace && preempt_active`, which missed
+        // the case where we're in kernel mode (CS=0x08) but PREEMPT_ACTIVE is set because
+        // we're in the middle of setting up the interrupt frame for userspace return.
+        // In that case, doing a context switch would corrupt partially-restored registers.
+        //
+        // NOTE: No logging here - we're in IRQ context and logging can deadlock.
         return;
     }
 
@@ -142,11 +164,12 @@ pub extern "C" fn check_need_resched_and_switch(
     let schedule_result = scheduler::schedule();
 
     // One-time boot stage marker (only fires once to satisfy boot-stages test)
+    // CRITICAL: Use raw serial to avoid deadlock in IRQ context
     static SCHEDULE_MARKER_EMITTED: core::sync::atomic::AtomicBool =
         core::sync::atomic::AtomicBool::new(false);
     if !SCHEDULE_MARKER_EMITTED.load(core::sync::atomic::Ordering::Relaxed) {
         SCHEDULE_MARKER_EMITTED.store(true, core::sync::atomic::Ordering::Relaxed);
-        log::info!("scheduler::schedule() returned: {:?} (boot marker)", schedule_result);
+        raw_serial_str("[ INFO] scheduler::schedule() returned (boot marker)\n");
     }
 
     if schedule_result.is_none() {
@@ -179,15 +202,14 @@ pub extern "C" fn check_need_resched_and_switch(
         // to a newly created kthread. Use raw_serial_char() for debugging only.
 
         // Emit canonical ring3 marker on the FIRST entry to userspace (for CI)
+        // CRITICAL: Use raw serial output without locks to prevent deadlock in IRQ context
         if from_userspace {
             static mut EMITTED_RING3_MARKER: bool = false;
             unsafe {
                 if !EMITTED_RING3_MARKER {
                     EMITTED_RING3_MARKER = true;
-                    crate::serial_println!("RING3_ENTER: CS=0x33");
-                    crate::serial_println!(
-                        "[ OK ] RING3_SMOKE: userspace executed + syscall path verified"
-                    );
+                    raw_serial_str("RING3_ENTER: CS=0x33\n");
+                    raw_serial_str("[ OK ] RING3_SMOKE: userspace executed + syscall path verified\n");
                 }
             }
         }
@@ -208,6 +230,8 @@ pub extern "C" fn check_need_resched_and_switch(
         if from_userspace {
             // Use the already-held guard to save context (prevents TOCTOU race)
             if let Some(ref mut guard) = process_manager_guard {
+                // Debug marker: saving userspace context (raw serial, no locks)
+                raw_serial_str("<S>");
                 if !save_current_thread_context_with_guard(old_thread_id, saved_regs, interrupt_frame, guard) {
                     log::error!(
                         "Context switch aborted: failed to save thread {} context. \
@@ -226,12 +250,7 @@ pub extern "C" fn check_need_resched_and_switch(
             // Thread is blocked inside a syscall (pause/waitpid) and was interrupted
             // in kernel mode (in the HLT loop). Save the KERNEL context so we can
             // resume the thread at the correct kernel location.
-            log::info!(
-                "Saving kernel context for thread {} blocked in syscall: RIP={:#x}, RSP={:#x}",
-                old_thread_id,
-                interrupt_frame.instruction_pointer.as_u64(),
-                interrupt_frame.stack_pointer.as_u64()
-            );
+            // NOTE: No logging here - this is a hot path during blocking I/O
             let save_succeeded = if let Some(ref mut guard) = process_manager_guard {
                 save_kernel_context_with_guard(old_thread_id, saved_regs, interrupt_frame, guard);
                 true
@@ -428,6 +447,8 @@ fn switch_to_thread(
     interrupt_frame: &mut InterruptStackFrame,
     process_manager_guard: Option<spin::MutexGuard<'static, Option<crate::process::ProcessManager>>>,
 ) {
+    // Debug marker: entering switch_to_thread (raw serial, no locks)
+    raw_serial_str("[SW]");
     // Update per-CPU current thread and TSS.RSP0
     scheduler::with_thread_mut(thread_id, |thread| {
         // Update per-CPU current thread pointer
@@ -453,6 +474,8 @@ fn switch_to_thread(
             log::error!("Failed to switch TLS for thread {}: {}", thread_id, e);
             return;
         }
+        // Debug marker: TLS switch completed (raw serial, no locks)
+        raw_serial_str("<T>");
     }
 
     // Check if this is the idle thread
@@ -469,24 +492,44 @@ fn switch_to_thread(
     if is_idle {
         // Check if idle thread has a saved context to restore
         // If it was preempted while running actual code (not idle_loop), restore that context
-        let has_saved_context = scheduler::with_thread_mut(thread_id, |thread| {
-            let idle_loop_addr = idle_loop as *const () as u64;
-            // Has saved context if RIP is non-zero AND not pointing to idle_loop
-            thread.context.rip != 0 && thread.context.rip != idle_loop_addr
-        }).unwrap_or(false);
+        //
+        // CRITICAL: After userspace starts (RING3_CONFIRMED), always go to idle_loop.
+        // Idle's saved context from boot may contain RIP values in kernel init code
+        // that cause hangs when restored during userspace operation.
+        let userspace_started = crate::syscall::handler::is_ring3_confirmed();
+
+        let has_saved_context = if userspace_started {
+            // After userspace starts, idle should always return to idle_loop
+            false
+        } else {
+            // During boot, may need to restore kernel init progress
+            scheduler::with_thread_mut(thread_id, |thread| {
+                let idle_loop_addr = idle_loop as *const () as u64;
+                // Has saved context if RIP is non-zero AND not pointing to idle_loop
+                thread.context.rip != 0 && thread.context.rip != idle_loop_addr
+            }).unwrap_or(false)
+        };
 
         if has_saved_context {
             // Restore idle thread's saved context (like a kthread)
+            // Debug marker: idle with saved context (raw serial, no locks)
+            raw_serial_str("<1>");
             log::trace!("Restoring idle thread's saved context");
             setup_kernel_thread_return(thread_id, saved_regs, interrupt_frame);
         } else {
             // No saved context or was in idle_loop - go to idle loop
+            // Debug marker: switching to idle (raw serial, no locks)
+            raw_serial_str("<I>");
             setup_idle_return(interrupt_frame);
         }
     } else if is_kernel_thread {
         // Set up to return to kernel thread
+        // Debug marker: kernel thread (raw serial, no locks)
+        raw_serial_str("<K>");
         setup_kernel_thread_return(thread_id, saved_regs, interrupt_frame);
     } else if blocked_in_syscall {
+        // Debug marker: blocked in syscall (raw serial, no locks)
+        raw_serial_str("<B>");
         // CRITICAL: Thread was blocked inside a syscall (like pause() or waitpid()).
         // We need to check if there are pending signals. If so, deliver them using
         // the saved userspace context. Otherwise, resume at the kernel HLT loop.
@@ -735,6 +778,8 @@ fn switch_to_thread(
         }
     } else {
         // Restore userspace thread context
+        // Debug marker: userspace restore path (raw serial, no locks)
+        raw_serial_str("<U>");
         // Pass the process_manager_guard to avoid double-lock
         restore_userspace_thread_context(thread_id, saved_regs, interrupt_frame, process_manager_guard);
     }
@@ -886,8 +931,9 @@ fn restore_userspace_thread_context(
             if let Some((pid, process)) = manager.find_process_by_thread_mut(thread_id) {
                 if let Some(ref mut thread) = process.main_thread {
                     if thread.privilege == ThreadPrivilege::User {
+                        // Debug marker: restoring userspace context (raw serial, no locks)
+                        raw_serial_str("<R>");
                         restore_userspace_context(thread, interrupt_frame, saved_regs);
-                        log::trace!("Restored context for thread {}", thread_id);
 
                         // CRITICAL: Defer CR3 switch to timer_entry.asm before IRETQ
                         // We do NOT switch CR3 here because:
diff --git a/kernel/src/keyboard.rs b/kernel/src/keyboard.rs
index ea79acf9..e9afc07b 100644
--- a/kernel/src/keyboard.rs
+++ b/kernel/src/keyboard.rs
@@ -116,6 +116,7 @@ pub fn process_scancode(scancode: u8) -> Option<KeyEvent> {
 /// - Line editing, echo, and signal generation
 ///
 /// Regular characters are pushed to the TTY layer for processing.
+#[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
 pub async fn keyboard_task() {
     log::info!(
         "Keyboard ready! Type to see characters (Ctrl+T/M/U/P/F/E/X/H for special actions)"
diff --git a/kernel/src/keyboard/event.rs b/kernel/src/keyboard/event.rs
index 2bdd5d2f..27e8ee55 100644
--- a/kernel/src/keyboard/event.rs
+++ b/kernel/src/keyboard/event.rs
@@ -8,6 +8,7 @@ pub struct KeyEvent {
 
 /// Convert a letter to its control character equivalent
 /// 'a' -> 0x01, 'b' -> 0x02, ..., 'z' -> 0x1A
+#[allow(dead_code)] // Used by is_ctrl_key (conditionally compiled)
 fn letter_to_ctrl_char(letter: char) -> char {
     // Handle both lowercase and uppercase
     let lower = if letter.is_ascii_uppercase() {
@@ -49,6 +50,7 @@ impl KeyEvent {
     }
 
     /// Check if this is Ctrl+T (time debug)
+    #[allow(dead_code)] // Used in keyboard_task (conditionally compiled)
     pub fn is_ctrl_t(&self) -> bool {
         // Ctrl+T produces 0x14
         self.ctrl && self.character == Some('\x14')
@@ -70,6 +72,7 @@ impl KeyEvent {
 
     /// Generic Ctrl+key check for letters a-z
     /// Accepts the letter (e.g., 'c') and checks if the character is the control equivalent (0x03)
+    #[allow(dead_code)] // Used in keyboard_task (conditionally compiled)
     pub fn is_ctrl_key(&self, key: char) -> bool {
         if !self.ctrl {
             return false;
diff --git a/kernel/src/keyboard/stream.rs b/kernel/src/keyboard/stream.rs
index 6e1b72d8..ab553e99 100644
--- a/kernel/src/keyboard/stream.rs
+++ b/kernel/src/keyboard/stream.rs
@@ -37,11 +37,13 @@ pub(crate) fn add_scancode(scancode: u8) {
     }
 }
 
+#[allow(dead_code)] // Used by keyboard_task (conditionally compiled)
 pub struct ScancodeStream {
     _private: (),
 }
 
 impl ScancodeStream {
+    #[allow(dead_code)] // Used by keyboard_task (conditionally compiled)
     pub fn new() -> Self {
         // Try to initialize, but it's ok if it's already initialized
         let _ = SCANCODE_QUEUE.try_init_once(|| ArrayQueue::new(100));
diff --git a/kernel/src/main.rs b/kernel/src/main.rs
index 9265eff6..a6ce8a0a 100644
--- a/kernel/src/main.rs
+++ b/kernel/src/main.rs
@@ -612,11 +612,129 @@ extern "C" fn kernel_main_on_kernel_stack(arg: *mut core::ffi::c_void) -> ! {
 
     // Continue with the rest of kernel initialization...
     // (This will include creating user processes, enabling interrupts, etc.)
-    #[cfg(not(any(feature = "kthread_stress_test", feature = "workqueue_test_only")))]
+    #[cfg(not(any(feature = "kthread_stress_test", feature = "workqueue_test_only", feature = "dns_test_only", feature = "blocking_recv_test")))]
     kernel_main_continue();
+
+    // DNS_TEST_ONLY mode: Skip all other tests, just run dns_test
+    #[cfg(feature = "dns_test_only")]
+    dns_test_only_main();
+
+    // BLOCKING_RECV_TEST mode: Skip all other tests, just run blocking_recv_test
+    #[cfg(feature = "blocking_recv_test")]
+    blocking_recv_test_main();
+}
+
+/// DNS test only mode - minimal boot, just run DNS test and exit
+#[cfg(feature = "dns_test_only")]
+fn dns_test_only_main() -> ! {
+    use alloc::string::String;
+
+    log::info!("=== DNS_TEST_ONLY: Starting minimal DNS test ===");
+
+    // Create dns_test process
+    x86_64::instructions::interrupts::without_interrupts(|| {
+        serial_println!("DNS_TEST_ONLY: Loading dns_test binary");
+        let elf = userspace_test::get_test_binary("dns_test");
+        match process::create_user_process(String::from("dns_test"), &elf) {
+            Ok(pid) => {
+                log::info!("DNS_TEST_ONLY: Created dns_test process with PID {}", pid.as_u64());
+            }
+            Err(e) => {
+                log::error!("DNS_TEST_ONLY: Failed to create dns_test: {}", e);
+                // Exit with error
+                unsafe {
+                    use x86_64::instructions::port::Port;
+                    let mut port = Port::new(0xf4);
+                    port.write(0x01u32);  // Error exit
+                }
+            }
+        }
+    });
+
+    // Enable interrupts so dns_test can run
+    log::info!("DNS_TEST_ONLY: Enabling interrupts");
+    x86_64::instructions::interrupts::enable();
+
+    // Enter idle loop - dns_test will run via scheduler
+    // The test harness watches for "DNS Test: All tests passed" marker
+    // and kills QEMU when it appears
+    log::info!("DNS_TEST_ONLY: Entering idle loop (dns_test running via scheduler)");
+    loop {
+        x86_64::instructions::interrupts::enable_and_hlt();
+
+        // Yield to give scheduler a chance
+        task::scheduler::yield_current();
+
+        // Poll for received packets (workaround for softirq timing)
+        net::process_rx();
+
+        // Drain loopback queue for localhost packets
+        net::drain_loopback_queue();
+    }
+}
+
+/// Blocking recvfrom test only mode - minimal boot, just run blocking_recv_test and exit
+#[cfg(feature = "blocking_recv_test")]
+fn blocking_recv_test_main() -> ! {
+    use alloc::string::String;
+
+    log::info!("=== BLOCKING_RECV_TEST: Starting minimal blocking recv test ===");
+
+    // Create blocking_recv_test process
+    x86_64::instructions::interrupts::without_interrupts(|| {
+        serial_println!("BLOCKING_RECV_TEST: Loading blocking_recv_test binary");
+        let elf = match userspace_test::load_test_binary_from_disk("blocking_recv_test") {
+            Ok(elf) => elf,
+            Err(e) => {
+                log::error!("BLOCKING_RECV_TEST: Failed to load blocking_recv_test: {}", e);
+                unsafe {
+                    use x86_64::instructions::port::Port;
+                    let mut port = Port::new(0xf4);
+                    port.write(0x01u32);
+                }
+                return;
+            }
+        };
+        match process::create_user_process(String::from("blocking_recv_test"), &elf) {
+            Ok(pid) => {
+                log::info!(
+                    "BLOCKING_RECV_TEST: Created blocking_recv_test process with PID {}",
+                    pid.as_u64()
+                );
+            }
+            Err(e) => {
+                log::error!("BLOCKING_RECV_TEST: Failed to create blocking_recv_test: {}", e);
+                unsafe {
+                    use x86_64::instructions::port::Port;
+                    let mut port = Port::new(0xf4);
+                    port.write(0x01u32);
+                }
+            }
+        }
+    });
+
+    // Enable interrupts so blocking_recv_test can run
+    log::info!("BLOCKING_RECV_TEST: Enabling interrupts");
+    x86_64::instructions::interrupts::enable();
+
+    // Enter idle loop - blocking_recv_test will run via scheduler
+    log::info!("BLOCKING_RECV_TEST: Entering idle loop (blocking_recv_test running via scheduler)");
+    loop {
+        x86_64::instructions::interrupts::enable_and_hlt();
+
+        // Yield to give scheduler a chance
+        task::scheduler::yield_current();
+
+        // Poll for received packets (workaround for softirq timing)
+        net::process_rx();
+
+        // Drain loopback queue for localhost packets
+        net::drain_loopback_queue();
+    }
 }
 
 /// Continue kernel initialization after setting up threading
+#[cfg(not(any(feature = "kthread_stress_test", feature = "workqueue_test_only", feature = "dns_test_only", feature = "blocking_recv_test")))]
 fn kernel_main_continue() -> ! {
     // INTERACTIVE MODE: Load init_shell as the only userspace process
     #[cfg(feature = "interactive")]
@@ -2286,6 +2404,13 @@ fn test_softirq() {
     log::info!("SOFTIRQ_TEST: ksoftirqd verification passed");
 
     log::info!("SOFTIRQ_TEST: all tests passed");
+
+    // CRITICAL: Restore the real network softirq handler!
+    // The tests above registered test handlers that override the real ones.
+    // Without this, network packets won't be processed after the tests.
+    crate::net::register_net_softirq();
+    log::info!("SOFTIRQ_TEST: Restored network softirq handler");
+
     log::info!("=== SOFTIRQ TEST: Completed ===");
 }
 
diff --git a/kernel/src/net/mod.rs b/kernel/src/net/mod.rs
index 48315f1f..ad5be0db 100644
--- a/kernel/src/net/mod.rs
+++ b/kernel/src/net/mod.rs
@@ -19,6 +19,7 @@ use alloc::vec::Vec;
 use spin::Mutex;
 
 use crate::drivers::e1000;
+use crate::task::softirqd::{register_softirq_handler, SoftirqType};
 
 /// Network interface configuration
 #[derive(Clone, Copy, Debug)]
@@ -98,8 +99,24 @@ pub fn drain_loopback_queue() {
     }
 }
 
+/// Softirq handler for network RX processing
+/// Called from softirq context when NetRx softirq is raised by e1000 interrupt handler
+fn net_rx_softirq_handler(_softirq: SoftirqType) {
+    process_rx();
+}
+
+/// Re-register the network softirq handler.
+/// This is needed after tests that override the handler for testing purposes.
+pub fn register_net_softirq() {
+    register_softirq_handler(SoftirqType::NetRx, net_rx_softirq_handler);
+}
+
 /// Initialize the network stack
 pub fn init() {
+    // Register NET_RX softirq handler FIRST - before any network operations
+    // This ensures the handler is ready before e1000 can raise the softirq
+    register_softirq_handler(SoftirqType::NetRx, net_rx_softirq_handler);
+
     log::info!("NET: Initializing network stack...");
 
     if let Some(mac) = e1000::mac_address() {
diff --git a/kernel/src/serial.rs b/kernel/src/serial.rs
index e1e20fcc..e87c6fc3 100644
--- a/kernel/src/serial.rs
+++ b/kernel/src/serial.rs
@@ -290,11 +290,13 @@ use core::{
 };
 use futures_util::stream::Stream;
 
+#[allow(dead_code)] // Used in serial_command_task (conditionally compiled)
 pub struct SerialInputStream {
     _private: (),
 }
 
 impl SerialInputStream {
+    #[allow(dead_code)] // Used in serial_command_task (conditionally compiled)
     pub fn new() -> Self {
         // Ensure queue is initialized
         let _ = SERIAL_INPUT_QUEUE.try_init_once(|| ArrayQueue::new(256));
diff --git a/kernel/src/serial/command.rs b/kernel/src/serial/command.rs
index 3b78234c..43d03e47 100644
--- a/kernel/src/serial/command.rs
+++ b/kernel/src/serial/command.rs
@@ -13,6 +13,7 @@ type CommandHandler = fn();
 // Registry for custom command handlers
 static COMMAND_REGISTRY: Once<CommandRegistry> = Once::new();
 
+#[allow(dead_code)] // Used by serial_command_task (conditionally compiled)
 struct CommandRegistry {
     ps_handler: Option<CommandHandler>,
     mem_handler: Option<CommandHandler>,
@@ -41,6 +42,7 @@ pub fn register_handlers(
 }
 
 /// Handle serial input with line editing and command processing
+#[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
 pub async fn serial_command_task() {
     log::info!("Serial command task started");
 
@@ -101,12 +103,14 @@ pub async fn serial_command_task() {
     }
 }
 
+#[allow(dead_code)] // Used by serial_command_task (conditionally compiled)
 fn print_prompt() {
     // Simple prompt
     write_byte(b'>');
     write_byte(b' ');
 }
 
+#[allow(dead_code)] // Used by serial_command_task (conditionally compiled)
 fn process_command(command: &str) {
     let trimmed = command.trim();
 
diff --git a/kernel/src/socket/udp.rs b/kernel/src/socket/udp.rs
index bfae42b2..a7b3b67a 100644
--- a/kernel/src/socket/udp.rs
+++ b/kernel/src/socket/udp.rs
@@ -36,8 +36,10 @@ pub struct UdpSocket {
     pub bound: bool,
     /// Receive queue for incoming packets (protected for interrupt-safe access)
     pub rx_queue: Mutex<VecDeque<UdpPacket>>,
-    /// Non-blocking mode flag (not yet used)
-    pub _nonblocking: bool,
+    /// Thread IDs blocked waiting for data on this socket
+    pub waiting_threads: Mutex<Vec<u64>>,
+    /// Non-blocking mode flag (default false = blocking)
+    pub nonblocking: bool,
 }
 
 impl core::fmt::Debug for UdpSocket {
@@ -47,7 +49,7 @@ impl core::fmt::Debug for UdpSocket {
             .field("local_addr", &self.local_addr)
             .field("local_port", &self.local_port)
             .field("bound", &self.bound)
-            .field("_nonblocking", &self._nonblocking)
+            .field("nonblocking", &self.nonblocking)
             .finish()
     }
 }
@@ -61,7 +63,8 @@ impl UdpSocket {
             local_port: None,
             bound: false,
             rx_queue: Mutex::new(VecDeque::new()),
-            _nonblocking: true, // Start non-blocking for simplicity
+            waiting_threads: Mutex::new(Vec::new()),
+            nonblocking: false, // Default to blocking (POSIX standard)
         }
     }
 
@@ -95,15 +98,43 @@ impl UdpSocket {
         self.rx_queue.lock().pop_front()
     }
 
-    /// Enqueue a received packet (called from interrupt context)
+    /// Enqueue a received packet (called from softirq context)
+    ///
+    /// After enqueuing, wakes all blocked threads so they can receive the packet.
+    ///
+    /// CRITICAL: This is called from softirq context which runs in irq_exit() BEFORE
+    /// returning to the preempted code. If syscall code holds waiting_threads lock
+    /// and we try to acquire it here, we would deadlock. The syscall code MUST
+    /// disable interrupts while holding waiting_threads lock to prevent this.
     pub fn enqueue_packet(&self, packet: UdpPacket) {
-        let mut queue = self.rx_queue.lock();
-        // Drop oldest if queue is full
-        if queue.len() >= MAX_RX_QUEUE_SIZE {
-            queue.pop_front();
-            log::warn!("UDP: RX queue full, dropped oldest packet");
+        // Enqueue the packet
+        {
+            let mut queue = self.rx_queue.lock();
+            // Drop oldest if queue is full
+            if queue.len() >= MAX_RX_QUEUE_SIZE {
+                queue.pop_front();
+                log::warn!("UDP: RX queue full, dropped oldest packet");
+            }
+            queue.push_back(packet);
+        }
+
+        // Wake ALL blocked threads (they'll race to receive)
+        // We MUST wake threads reliably - use regular lock, not try_lock.
+        // Softirq context is safe for blocking since interrupts are enabled.
+        let readers: alloc::vec::Vec<u64> = {
+            let mut waiting = self.waiting_threads.lock();
+            waiting.drain(..).collect()
+        };
+
+        if !readers.is_empty() {
+            crate::task::scheduler::with_scheduler(|sched| {
+                for thread_id in &readers {
+                    sched.unblock(*thread_id);
+                }
+            });
+            // Trigger reschedule so woken threads run soon
+            crate::task::scheduler::set_need_resched();
         }
-        queue.push_back(packet);
     }
 
     /// Check if there are packets available to receive (part of API)
@@ -126,6 +157,27 @@ impl UdpSocket {
     pub fn local_port(&self) -> Option<u16> {
         self.local_port
     }
+
+    /// Register a thread as waiting for data on this socket
+    pub fn register_waiter(&self, thread_id: u64) {
+        let mut waiting = self.waiting_threads.lock();
+        if !waiting.contains(&thread_id) {
+            waiting.push(thread_id);
+            log::trace!("UDP: Thread {} registered as waiter", thread_id);
+        }
+    }
+
+    /// Unregister a thread from waiting for data
+    pub fn unregister_waiter(&self, thread_id: u64) {
+        let mut waiting = self.waiting_threads.lock();
+        waiting.retain(|&id| id != thread_id);
+    }
+
+    /// Set non-blocking mode for this socket
+    #[allow(dead_code)] // Public API for future fcntl O_NONBLOCK support
+    pub fn set_nonblocking(&mut self, nonblocking: bool) {
+        self.nonblocking = nonblocking;
+    }
 }
 
 impl Default for UdpSocket {
@@ -143,3 +195,389 @@ impl Drop for UdpSocket {
         }
     }
 }
+
+#[cfg(test)]
+/// Unit tests here validate local UDP socket behavior but cannot exercise the
+/// syscall-level blocking path (requires multi-threaded execution). We
+/// simulate blocked threads by manually setting thread state; integration
+/// tests via telnetd and DNS in Docker provide full path coverage.
+pub mod tests {
+    use super::*;
+    use alloc::boxed::Box;
+    use alloc::string::String;
+    use crate::task::scheduler;
+    use crate::task::thread::{Thread, ThreadPrivilege, ThreadState};
+    use x86_64::VirtAddr;
+
+    fn dummy_entry() {}
+
+    fn make_thread(id: u64, state: ThreadState) -> Box<Thread> {
+        let mut thread = Thread::new_with_id(
+            id,
+            String::from("udp-test-thread"),
+            dummy_entry,
+            VirtAddr::new(0x1000),
+            VirtAddr::new(0x800),
+            VirtAddr::new(0),
+            ThreadPrivilege::Kernel,
+        );
+        thread.state = state;
+        Box::new(thread)
+    }
+
+    pub fn test_register_waiter_adds_thread() {
+        log::info!("=== TEST: register_waiter adds thread ID ===");
+
+        let socket = UdpSocket::new();
+        let thread_id = 42;
+
+        socket.register_waiter(thread_id);
+
+        let waiting = socket.waiting_threads.lock();
+        assert_eq!(waiting.contains(&thread_id), true);
+        assert_eq!(waiting.len(), 1);
+
+        log::info!("=== TEST PASSED: register_waiter adds thread ID ===");
+    }
+
+    pub fn test_register_waiter_duplicate_prevention() {
+        log::info!("=== TEST: register_waiter prevents duplicates ===");
+
+        let socket = UdpSocket::new();
+        let thread_id = 42;
+
+        socket.register_waiter(thread_id);
+        socket.register_waiter(thread_id);
+
+        let waiting = socket.waiting_threads.lock();
+        assert_eq!(waiting.len(), 1);
+
+        log::info!("=== TEST PASSED: register_waiter prevents duplicates ===");
+    }
+
+    pub fn test_unregister_waiter_removes_thread() {
+        log::info!("=== TEST: unregister_waiter removes thread ID ===");
+
+        let socket = UdpSocket::new();
+        let thread_id = 42;
+        let other_thread_id = 7;
+
+        socket.register_waiter(thread_id);
+        socket.register_waiter(other_thread_id);
+        socket.unregister_waiter(thread_id);
+
+        let waiting = socket.waiting_threads.lock();
+        assert_eq!(waiting.contains(&thread_id), false);
+        assert_eq!(waiting.contains(&other_thread_id), true);
+        assert_eq!(waiting.len(), 1);
+
+        log::info!("=== TEST PASSED: unregister_waiter removes thread ID ===");
+    }
+
+    pub fn test_unregister_nonexistent_waiter() {
+        log::info!("=== TEST: unregister_waiter ignores missing thread ID ===");
+
+        let socket = UdpSocket::new();
+
+        socket.unregister_waiter(999);
+
+        let waiting = socket.waiting_threads.lock();
+        assert_eq!(waiting.len(), 0);
+
+        log::info!("=== TEST PASSED: unregister_waiter ignores missing thread ID ===");
+    }
+
+    pub fn test_has_data_after_enqueue_packet() {
+        log::info!("=== TEST: has_data reflects enqueue_packet ===");
+
+        let socket = UdpSocket::new();
+        assert_eq!(socket.has_data(), false);
+
+        let packet = UdpPacket {
+            src_addr: [127, 0, 0, 1],
+            src_port: 1234,
+            data: alloc::vec![1, 2, 3],
+        };
+        socket.enqueue_packet(packet);
+
+        assert_eq!(socket.has_data(), true);
+
+        log::info!("=== TEST PASSED: has_data reflects enqueue_packet ===");
+    }
+
+    pub fn test_enqueue_packet_wakes_blocked_threads() {
+        log::info!("=== TEST: enqueue_packet wakes blocked threads ===");
+
+        let socket = UdpSocket::new();
+        let idle_thread = make_thread(1, ThreadState::Ready);
+        scheduler::init(idle_thread);
+
+        let blocked_thread_id = 2;
+        let blocked_thread = make_thread(blocked_thread_id, ThreadState::Blocked);
+        let added = scheduler::with_scheduler(|sched| {
+            sched.add_thread(blocked_thread);
+            if let Some(thread) = sched.get_thread_mut(blocked_thread_id) {
+                thread.state = ThreadState::Blocked;
+            }
+            sched.remove_from_ready_queue(blocked_thread_id);
+        });
+        assert_eq!(added.is_some(), true);
+
+        socket.register_waiter(blocked_thread_id);
+
+        let packet = UdpPacket {
+            src_addr: [10, 0, 2, 15],
+            src_port: 4321,
+            data: alloc::vec![0xaa],
+        };
+        socket.enqueue_packet(packet);
+
+        assert_eq!(socket.waiting_threads.lock().is_empty(), true);
+
+        let state_ready = scheduler::with_scheduler(|sched| {
+            sched
+                .get_thread(blocked_thread_id)
+                .map(|thread| thread.state == ThreadState::Ready)
+                .unwrap_or(false)
+        });
+        assert_eq!(state_ready, Some(true));
+
+        log::info!("=== TEST PASSED: enqueue_packet wakes blocked threads ===");
+    }
+
+    pub fn test_blocking_recvfrom_blocks_and_wakes() {
+        log::info!("=== TEST: blocking recvfrom blocks and wakes ===");
+
+        let socket = UdpSocket::new();
+        let idle_thread = make_thread(1, ThreadState::Ready);
+        scheduler::init(idle_thread);
+
+        // This test simulates blocking by manually marking a thread as blocked.
+        // True syscall-level blocking needs multi-threaded execution and is
+        // covered by telnetd and DNS integration tests in Docker. This test
+        // verifies the WAKE path, not the BLOCK path.
+        let blocked_thread_id = 2;
+        let blocked_thread = make_thread(blocked_thread_id, ThreadState::Blocked);
+        let added = scheduler::with_scheduler(|sched| {
+            sched.add_thread(blocked_thread);
+            if let Some(thread) = sched.get_thread_mut(blocked_thread_id) {
+                thread.state = ThreadState::Blocked;
+                thread.blocked_in_syscall = true;
+            }
+            sched.remove_from_ready_queue(blocked_thread_id);
+        });
+        assert_eq!(added.is_some(), true);
+
+        socket.register_waiter(blocked_thread_id);
+
+        let state_blocked = scheduler::with_scheduler(|sched| {
+            sched.get_thread(blocked_thread_id).map(|thread| {
+                thread.state == ThreadState::Blocked && thread.blocked_in_syscall
+            })
+        });
+        assert_eq!(state_blocked, Some(Some(true)));
+
+        let packet = UdpPacket {
+            src_addr: [10, 0, 2, 15],
+            src_port: 4321,
+            data: alloc::vec![0xaa],
+        };
+        socket.enqueue_packet(packet);
+
+        assert_eq!(socket.waiting_threads.lock().is_empty(), true);
+
+        let state_ready = scheduler::with_scheduler(|sched| {
+            sched.get_thread(blocked_thread_id).map(|thread| thread.state == ThreadState::Ready)
+        });
+        assert_eq!(state_ready, Some(Some(true)));
+
+        log::info!("=== TEST PASSED: blocking recvfrom blocks and wakes ===");
+    }
+
+    /// Test that multiple blocked threads are all woken when packet arrives
+    pub fn test_enqueue_packet_wakes_multiple_waiters() {
+        log::info!("=== TEST: enqueue_packet wakes multiple waiters ===");
+
+        let socket = UdpSocket::new();
+        let idle_thread = make_thread(1, ThreadState::Ready);
+        scheduler::init(idle_thread);
+
+        // Create multiple blocked threads
+        let thread_ids = [10u64, 11, 12];
+        for &tid in &thread_ids {
+            let thread = make_thread(tid, ThreadState::Blocked);
+            scheduler::with_scheduler(|sched| {
+                sched.add_thread(thread);
+                if let Some(t) = sched.get_thread_mut(tid) {
+                    t.state = ThreadState::Blocked;
+                }
+                sched.remove_from_ready_queue(tid);
+            });
+            socket.register_waiter(tid);
+        }
+
+        // Verify all are registered
+        assert_eq!(socket.waiting_threads.lock().len(), 3);
+
+        // Enqueue packet - should wake all
+        let packet = UdpPacket {
+            src_addr: [10, 0, 2, 15],
+            src_port: 4321,
+            data: alloc::vec![0xaa, 0xbb],
+        };
+        socket.enqueue_packet(packet);
+
+        // Verify wait queue is empty (all unregistered during wake)
+        assert_eq!(socket.waiting_threads.lock().is_empty(), true);
+
+        // Verify all threads are now Ready
+        for &tid in &thread_ids {
+            let is_ready = scheduler::with_scheduler(|sched| {
+                sched.get_thread(tid).map(|t| t.state == ThreadState::Ready)
+            });
+            assert_eq!(is_ready, Some(Some(true)), "Thread {} should be Ready", tid);
+        }
+
+        log::info!("=== TEST PASSED: enqueue_packet wakes multiple waiters ===");
+    }
+
+    /// Test nonblocking mode flag behavior
+    pub fn test_nonblocking_mode_flag() {
+        log::info!("=== TEST: nonblocking mode flag ===");
+
+        let mut socket = UdpSocket::new();
+
+        // Default should be blocking
+        assert_eq!(socket.nonblocking, false);
+
+        // Set to nonblocking
+        socket.set_nonblocking(true);
+        assert_eq!(socket.nonblocking, true);
+        assert!(socket.recv_from().is_none());
+
+        // Set back to blocking
+        socket.set_nonblocking(false);
+        assert_eq!(socket.nonblocking, false);
+
+        log::info!("=== TEST PASSED: nonblocking mode flag ===");
+    }
+
+    /// Test recv_from properly dequeues packets
+    pub fn test_recv_from_dequeues_packets() {
+        log::info!("=== TEST: recv_from dequeues packets in FIFO order ===");
+
+        let socket = UdpSocket::new();
+
+        // Enqueue multiple packets
+        for i in 0..3u8 {
+            let packet = UdpPacket {
+                src_addr: [192, 168, 1, i],
+                src_port: 1000 + i as u16,
+                data: alloc::vec![i, i + 1],
+            };
+            socket.enqueue_packet(packet);
+        }
+
+        assert_eq!(socket.rx_queue.lock().len(), 3);
+
+        // Receive first packet
+        let pkt1 = socket.recv_from();
+        assert!(pkt1.is_some());
+        let pkt1 = pkt1.unwrap();
+        assert_eq!(pkt1.src_addr, [192, 168, 1, 0]);
+        assert_eq!(pkt1.src_port, 1000);
+        assert_eq!(pkt1.data, alloc::vec![0, 1]);
+
+        // Receive second packet
+        let pkt2 = socket.recv_from();
+        assert!(pkt2.is_some());
+        let pkt2 = pkt2.unwrap();
+        assert_eq!(pkt2.src_addr, [192, 168, 1, 1]);
+        assert_eq!(pkt2.src_port, 1001);
+
+        // Receive third packet
+        let pkt3 = socket.recv_from();
+        assert!(pkt3.is_some());
+        assert_eq!(pkt3.unwrap().src_addr, [192, 168, 1, 2]);
+
+        // Queue should be empty now
+        assert!(!socket.has_data());
+        assert!(socket.recv_from().is_none());
+
+        log::info!("=== TEST PASSED: recv_from dequeues packets in FIFO order ===");
+    }
+
+    /// Test has_data() reflects receive queue state.
+    ///
+    /// This checks has_data() tracks queue state for the blocking recvfrom path.
+    /// True concurrent race testing would require multi-threaded execution, which
+    /// is not feasible in kernel unit tests. The actual race protection relies on
+    /// sys_recvfrom implementing the double-check pattern correctly.
+    pub fn test_has_data_reflects_queue_state() {
+        log::info!("=== TEST: has_data reflects queue state ===");
+
+        let socket = UdpSocket::new();
+
+        // Simulate the blocking path: first check shows no data
+        assert!(!socket.has_data());
+
+        // Simulate: we would set thread to Blocked here (in actual syscall)
+        // Then a packet arrives during the race window
+        let packet = UdpPacket {
+            src_addr: [127, 0, 0, 1],
+            src_port: 53,
+            data: alloc::vec![0xDE, 0xAD, 0xBE, 0xEF],
+        };
+        socket.enqueue_packet(packet);
+
+        // The double-check: has_data() should now return true
+        // This is the check that prevents the race condition
+        assert!(socket.has_data());
+
+        // The fix: if has_data() returns true in double-check,
+        // thread unblocks itself and retries receive
+        let received = socket.recv_from();
+        assert!(received.is_some());
+        assert_eq!(received.unwrap().data, alloc::vec![0xDE, 0xAD, 0xBE, 0xEF]);
+
+        log::info!("=== TEST PASSED: has_data reflects queue state ===");
+    }
+
+    /// Test RX queue overflow behavior (drops oldest packet)
+    pub fn test_rx_queue_overflow() {
+        log::info!("=== TEST: RX queue overflow drops oldest ===");
+
+        let socket = UdpSocket::new();
+
+        // Fill queue to MAX_RX_QUEUE_SIZE (32)
+        for i in 0..MAX_RX_QUEUE_SIZE {
+            let i = i as u8;
+            let packet = UdpPacket {
+                src_addr: [10, 0, 0, i],
+                src_port: i as u16,
+                data: alloc::vec![i],
+            };
+            socket.enqueue_packet(packet);
+        }
+
+        assert_eq!(socket.rx_queue.lock().len(), MAX_RX_QUEUE_SIZE);
+
+        // Add one more - should drop oldest (i=0)
+        let packet = UdpPacket {
+            src_addr: [10, 0, 0, 99],
+            src_port: 99,
+            data: alloc::vec![99],
+        };
+        socket.enqueue_packet(packet);
+
+        // Still MAX_RX_QUEUE_SIZE packets
+        assert_eq!(socket.rx_queue.lock().len(), MAX_RX_QUEUE_SIZE);
+
+        // First packet should now be i=1 (i=0 was dropped)
+        let first = socket.recv_from().unwrap();
+        assert_eq!(first.src_addr, [10, 0, 0, 1]);
+        assert_eq!(first.data, alloc::vec![1]);
+
+        log::info!("=== TEST PASSED: RX queue overflow drops oldest ===");
+    }
+}
diff --git a/kernel/src/syscall/handler.rs b/kernel/src/syscall/handler.rs
index 8bc11817..d3b57fe2 100644
--- a/kernel/src/syscall/handler.rs
+++ b/kernel/src/syscall/handler.rs
@@ -135,6 +135,13 @@ impl crate::arch_impl::traits::SyscallFrame for SyscallFrame {
 // Static flag to track first Ring 3 syscall
 static RING3_CONFIRMED: AtomicBool = AtomicBool::new(false);
 
+/// Returns true if userspace has started (first Ring 3 syscall received).
+/// Used by scheduler to determine if idle thread should use idle_loop or
+/// restore saved context from boot.
+pub fn is_ring3_confirmed() -> bool {
+    RING3_CONFIRMED.load(Ordering::Relaxed)
+}
+
 /// Main syscall handler called from assembly
 ///
 /// CRITICAL: This is a hot path. NO logging, NO serial output, NO allocations.
@@ -352,3 +359,53 @@ pub extern "C" fn trace_iretq_to_ring3(_frame_ptr: *const u64) {
     // Intentionally empty - diagnostics were causing timer to preempt before
     // userspace could execute. See commit history for the original diagnostic code.
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Test that is_ring3_confirmed() returns false initially (before any Ring 3 syscalls)
+    ///
+    /// NOTE: This test can only verify the initial state. Once RING3_CONFIRMED is set
+    /// to true by a real syscall, it cannot be reset (by design - it's a one-way flag).
+    /// The actual state change from false->true is tested implicitly by the kernel
+    /// boot process and verified by the RING3_CONFIRMED marker in serial output.
+    #[test]
+    fn test_is_ring3_confirmed_initial_state() {
+        // In a test context, RING3_CONFIRMED starts as false.
+        // NOTE: If other tests in this test run have already triggered a syscall,
+        // this test may see true. The important behavior is the one-way transition.
+        let initial = RING3_CONFIRMED.load(Ordering::Relaxed);
+
+        // If it's false, verify is_ring3_confirmed() returns false
+        if !initial {
+            assert!(!is_ring3_confirmed());
+        }
+        // If it's already true (from another test), that's also valid - the flag
+        // should never go back to false once set.
+    }
+
+    /// Test the atomic swap behavior of RING3_CONFIRMED
+    ///
+    /// The key property: swap(true) returns the previous value, allowing
+    /// exactly-once detection of the first Ring 3 syscall.
+    #[test]
+    fn test_ring3_confirmed_swap_behavior() {
+        // Get current state
+        let was_confirmed = RING3_CONFIRMED.load(Ordering::Relaxed);
+
+        // Swap to true
+        let prev = RING3_CONFIRMED.swap(true, Ordering::SeqCst);
+
+        // If it wasn't confirmed before, swap should return false
+        // If it was confirmed, swap returns true
+        assert_eq!(prev, was_confirmed);
+
+        // After swap, should always be true
+        assert!(is_ring3_confirmed());
+
+        // Second swap should return true (idempotent)
+        let second = RING3_CONFIRMED.swap(true, Ordering::SeqCst);
+        assert!(second);
+    }
+}
diff --git a/kernel/src/syscall/handlers.rs b/kernel/src/syscall/handlers.rs
index feb067d8..0f305e3e 100644
--- a/kernel/src/syscall/handlers.rs
+++ b/kernel/src/syscall/handlers.rs
@@ -774,8 +774,8 @@ pub fn sys_read(fd: u64, buf_ptr: u64, count: u64) -> SyscallResult {
         }
         FdKind::TcpConnection(conn_id) => {
             // Read from TCP connection
-            // First process any pending network packets
-            crate::net::process_rx();
+            // Drain loopback queue for localhost connections (127.x.x.x, own IP).
+            // Hardware-received packets arrive via interrupt → softirq → process_rx().
             crate::net::drain_loopback_queue();
             let mut user_buf = alloc::vec![0u8; count as usize];
             match crate::net::tcp::tcp_recv(conn_id, &mut user_buf) {
@@ -2296,10 +2296,8 @@ pub fn sys_poll(fds_ptr: u64, nfds: u64, _timeout: i32) -> SyscallResult {
 
     log::debug!("sys_poll: fds_ptr={:#x}, nfds={}, timeout={}", fds_ptr, nfds, _timeout);
 
-    // Process any pending network packets before checking fd readiness.
-    // This is critical for TCP listeners - without this, incoming SYN packets
-    // remain unprocessed in the e1000 driver buffer and accept() never sees connections.
-    crate::net::process_rx();
+    // Drain loopback queue for localhost connections (127.x.x.x, own IP).
+    // Hardware-received packets arrive via interrupt → softirq → process_rx().
     crate::net::drain_loopback_queue();
 
     // Validate parameters
@@ -2430,10 +2428,8 @@ pub fn sys_select(
         nfds, readfds_ptr, writefds_ptr, exceptfds_ptr, _timeout_ptr
     );
 
-    // Process any pending network packets before checking fd readiness.
-    // This is critical for TCP listeners - without this, incoming SYN packets
-    // remain unprocessed in the e1000 driver buffer and accept() never sees connections.
-    crate::net::process_rx();
+    // Drain loopback queue for localhost connections (127.x.x.x, own IP).
+    // Hardware-received packets arrive via interrupt → softirq → process_rx().
     crate::net::drain_loopback_queue();
 
     // Validate nfds - must be non-negative and <= 64 (we only support u64 bitmaps)
diff --git a/kernel/src/syscall/pipe.rs b/kernel/src/syscall/pipe.rs
index c8d53018..244fa5d7 100644
--- a/kernel/src/syscall/pipe.rs
+++ b/kernel/src/syscall/pipe.rs
@@ -211,6 +211,7 @@ pub fn sys_close(fd: i32) -> SyscallResult {
                     log::debug!("sys_close: Closed PTY slave fd={} (pty {})", fd, pty_num);
                 }
             }
+            log::debug!("sys_close: returning to userspace fd={}", fd);
             SyscallResult::Ok(0)
         }
         Err(e) => {
diff --git a/kernel/src/syscall/socket.rs b/kernel/src/syscall/socket.rs
index cffec985..31d37aa1 100644
--- a/kernel/src/syscall/socket.rs
+++ b/kernel/src/syscall/socket.rs
@@ -8,6 +8,8 @@ use crate::socket::types::{AF_INET, SOCK_DGRAM, SOCK_STREAM, SockAddrIn};
 use crate::socket::udp::UdpSocket;
 use crate::ipc::fd::FdKind;
 
+const SOCK_NONBLOCK: u64 = 0x800;
+
 /// sys_socket - Create a new socket
 ///
 /// Arguments:
@@ -51,11 +53,18 @@ pub fn sys_socket(domain: u64, sock_type: u64, _protocol: u64) -> SyscallResult
         }
     };
 
+    let nonblocking = (sock_type & SOCK_NONBLOCK) != 0;
+    let base_type = sock_type & !SOCK_NONBLOCK;
+
     // Create socket based on type
-    let fd_kind = match sock_type as u16 {
+    let fd_kind = match base_type as u16 {
         SOCK_DGRAM => {
             // Create UDP socket wrapped in Arc<Mutex<>> for sharing
-            let socket = alloc::sync::Arc::new(spin::Mutex::new(UdpSocket::new()));
+            let mut socket = UdpSocket::new();
+            if nonblocking {
+                socket.set_nonblocking(true);
+            }
+            let socket = alloc::sync::Arc::new(spin::Mutex::new(socket));
             FdKind::UdpSocket(socket)
         }
         SOCK_STREAM => {
@@ -63,7 +72,7 @@ pub fn sys_socket(domain: u64, sock_type: u64, _protocol: u64) -> SyscallResult
             FdKind::TcpSocket(0)
         }
         _ => {
-            log::debug!("sys_socket: unsupported type {}", sock_type);
+            log::debug!("sys_socket: unsupported type {}", base_type);
             return SyscallResult::Err(EINVAL as u64);
         }
     };
@@ -71,8 +80,9 @@ pub fn sys_socket(domain: u64, sock_type: u64, _protocol: u64) -> SyscallResult
     // Allocate file descriptor in process
     match process.fd_table.alloc(fd_kind) {
         Ok(num) => {
-            let kind_str = if sock_type as u16 == SOCK_STREAM { "TCP" } else { "UDP" };
+            let kind_str = if base_type as u16 == SOCK_STREAM { "TCP" } else { "UDP" };
             log::info!("{}: Socket created fd={}", kind_str, num);
+            log::debug!("{} socket: returning to userspace fd={}", kind_str, num);
             SyscallResult::Ok(num as u64)
         }
         Err(e) => {
@@ -153,6 +163,7 @@ pub fn sys_bind(fd: u64, addr_ptr: u64, addrlen: u64) -> SyscallResult {
             match socket.bind(pid, addr.addr, addr.port_host()) {
                 Ok(actual_port) => {
                     log::info!("UDP: Socket bound to port {} (requested: {})", actual_port, addr.port_host());
+                    log::debug!("UDP bind: returning to userspace");
                     SyscallResult::Ok(0)
                 }
                 Err(e) => SyscallResult::Err(e as u64),
@@ -287,6 +298,7 @@ pub fn sys_sendto(
     match result {
         Ok(()) => {
             log::info!("UDP: Packet sent successfully, bytes={}", data.len());
+            log::debug!("UDP sendto: returning to userspace");
             SyscallResult::Ok(data.len() as u64)
         }
         Err(_) => SyscallResult::Err(ENETUNREACH as u64),
@@ -304,6 +316,11 @@ pub fn sys_sendto(
 ///   addrlen: Pointer to address length (can be NULL)
 ///
 /// Returns: bytes received on success, negative errno on error
+///
+/// Blocking behavior:
+///   By default, UDP sockets are blocking. If no data is available, the calling
+///   thread will block until a packet arrives. For non-blocking sockets (set via
+///   fcntl O_NONBLOCK), EAGAIN is returned immediately when no data is available.
 pub fn sys_recvfrom(
     fd: u64,
     buf_ptr: u64,
@@ -312,8 +329,10 @@ pub fn sys_recvfrom(
     src_addr_ptr: u64,
     addrlen_ptr: u64,
 ) -> SyscallResult {
-    // Process any pending network packets before checking for received data.
-    crate::net::process_rx();
+    log::debug!("sys_recvfrom: fd={}, buf_ptr=0x{:x}, len={}", fd, buf_ptr, len);
+
+    // Drain loopback queue for packets sent to ourselves (127.x.x.x, own IP).
+    // Hardware-received packets arrive via interrupt → softirq → process_rx().
     crate::net::drain_loopback_queue();
 
     // Validate buffer pointer
@@ -321,8 +340,8 @@ pub fn sys_recvfrom(
         return SyscallResult::Err(EFAULT as u64);
     }
 
-    // Get current thread and process (same pattern as mmap.rs)
-    let current_thread_id = match crate::per_cpu::current_thread() {
+    // Get current thread ID for blocking
+    let thread_id = match crate::per_cpu::current_thread() {
         Some(thread) => thread.id,
         None => {
             log::error!("sys_recvfrom: No current thread in per-CPU data!");
@@ -330,67 +349,203 @@ pub fn sys_recvfrom(
         }
     };
 
-    let mut manager_guard = crate::process::manager();
-    let manager = match *manager_guard {
-        Some(ref mut m) => m,
-        None => {
-            return SyscallResult::Err(ErrorCode::NoSuchProcess as u64);
-        }
-    };
+    // Get socket reference and nonblocking flag
+    let (socket_ref, is_nonblocking) = {
+        let mut manager_guard = crate::process::manager();
+        let manager = match *manager_guard {
+            Some(ref mut m) => m,
+            None => {
+                return SyscallResult::Err(ErrorCode::NoSuchProcess as u64);
+            }
+        };
 
-    let (_pid, process) = match manager.find_process_by_thread_mut(current_thread_id) {
-        Some(p) => p,
-        None => {
-            log::error!("sys_recvfrom: No process found for thread_id={}", current_thread_id);
-            return SyscallResult::Err(ErrorCode::NoSuchProcess as u64);
-        }
-    };
+        let (_pid, process) = match manager.find_process_by_thread_mut(thread_id) {
+            Some(p) => p,
+            None => {
+                log::error!("sys_recvfrom: No process found for thread_id={}", thread_id);
+                return SyscallResult::Err(ErrorCode::NoSuchProcess as u64);
+            }
+        };
 
-    // Get the socket from fd table
-    let fd_entry = match process.fd_table.get(fd as i32) {
-        Some(e) => e,
-        None => return SyscallResult::Err(EBADF as u64),
-    };
+        // Get the socket from fd table
+        let fd_entry = match process.fd_table.get(fd as i32) {
+            Some(e) => e,
+            None => return SyscallResult::Err(EBADF as u64),
+        };
 
-    // Verify it's a UDP socket and get Arc<Mutex<>> reference
-    let socket_ref = match &fd_entry.kind {
-        FdKind::UdpSocket(s) => s.clone(),
-        _ => return SyscallResult::Err(ENOTSOCK as u64),
-    };
+        // Verify it's a UDP socket and get Arc<Mutex<>> reference
+        let socket = match &fd_entry.kind {
+            FdKind::UdpSocket(s) => s.clone(),
+            _ => return SyscallResult::Err(ENOTSOCK as u64),
+        };
 
-    // Try to receive a packet (lock the mutex)
-    let packet = match socket_ref.lock().recv_from() {
-        Some(p) => p,
-        None => return SyscallResult::Err(EAGAIN as u64), // Would block
-    };
+        let nonblocking = socket.lock().nonblocking;
+        (socket, nonblocking)
+        // manager_guard dropped here
+    };
+
+    // Blocking receive loop
+    loop {
+        // Register as waiter FIRST to avoid race condition where packet
+        // arrives between checking and blocking.
+        // CRITICAL: Disable interrupts while holding waiting_threads lock to prevent
+        // deadlock with softirq (which runs in irq_exit before returning to us).
+        x86_64::instructions::interrupts::without_interrupts(|| {
+            socket_ref.lock().register_waiter(thread_id);
+        });
+
+        // Drain loopback queue again in case packets arrived
+        crate::net::drain_loopback_queue();
+
+        // Try to receive a packet
+        // CRITICAL: Must disable interrupts to prevent deadlock with softirq.
+        // If we hold rx_queue lock and NIC interrupt fires, softirq will try to
+        // acquire the same lock in enqueue_packet() -> deadlock!
+        let packet_opt = x86_64::instructions::interrupts::without_interrupts(|| {
+            socket_ref.lock().recv_from()
+        });
+        if let Some(packet) = packet_opt {
+            // Data was available - unregister from waiters
+            x86_64::instructions::interrupts::without_interrupts(|| {
+                socket_ref.lock().unregister_waiter(thread_id);
+            });
+
+            // Copy data to userspace
+            let copy_len = core::cmp::min(len as usize, packet.data.len());
+            unsafe {
+                let buf = core::slice::from_raw_parts_mut(buf_ptr as *mut u8, copy_len);
+                buf.copy_from_slice(&packet.data[..copy_len]);
+            }
 
-    // Copy data to userspace
-    let copy_len = core::cmp::min(len as usize, packet.data.len());
-    unsafe {
-        let buf = core::slice::from_raw_parts_mut(buf_ptr as *mut u8, copy_len);
-        buf.copy_from_slice(&packet.data[..copy_len]);
-    }
+            // Write source address if requested
+            if src_addr_ptr != 0 && addrlen_ptr != 0 {
+                let src_addr = SockAddrIn::new(packet.src_addr, packet.src_port);
+                let addr_bytes = src_addr.to_bytes();
+                unsafe {
+                    let addrlen = *(addrlen_ptr as *const u32);
+                    let copy_addr_len = core::cmp::min(addrlen as usize, addr_bytes.len());
+                    let addr_buf = core::slice::from_raw_parts_mut(src_addr_ptr as *mut u8, copy_addr_len);
+                    addr_buf.copy_from_slice(&addr_bytes[..copy_addr_len]);
+                    *(addrlen_ptr as *mut u32) = addr_bytes.len() as u32;
+                }
+            }
 
-    // Write source address if requested
-    if src_addr_ptr != 0 && addrlen_ptr != 0 {
-        let src_addr = SockAddrIn::new(packet.src_addr, packet.src_port);
-        let addr_bytes = src_addr.to_bytes();
-        unsafe {
-            let addrlen = *(addrlen_ptr as *const u32);
-            let copy_addr_len = core::cmp::min(addrlen as usize, addr_bytes.len());
-            let addr_buf = core::slice::from_raw_parts_mut(src_addr_ptr as *mut u8, copy_addr_len);
-            addr_buf.copy_from_slice(&addr_bytes[..copy_addr_len]);
-            *(addrlen_ptr as *mut u32) = addr_bytes.len() as u32;
+            log::debug!("UDP: Received {} bytes from {}.{}.{}.{}:{}",
+                copy_len,
+                packet.src_addr[0], packet.src_addr[1], packet.src_addr[2], packet.src_addr[3],
+                packet.src_port
+            );
+
+            return SyscallResult::Ok(copy_len as u64);
+        }
+
+        // No data available
+        if is_nonblocking {
+            x86_64::instructions::interrupts::without_interrupts(|| {
+                socket_ref.lock().unregister_waiter(thread_id);
+            });
+            return SyscallResult::Err(EAGAIN as u64);
+        }
+
+        // === BLOCKING PATH ===
+        // Following the same pattern as stdin blocking in sys_read
+        log::debug!("UDP recvfrom: fd={} entering blocking path, thread={}", fd, thread_id);
+
+        // Block the current thread AND set blocked_in_syscall flag.
+        // CRITICAL: Setting blocked_in_syscall is essential because:
+        // 1. The thread will enter a kernel-mode HLT loop below
+        // 2. If a context switch happens while in HLT, the scheduler sees
+        //    from_userspace=false (kernel mode) but blocked_in_syscall tells
+        //    it to save/restore kernel context, not userspace context
+        // 3. Without this flag, no context is saved when switching away,
+        //    and stale userspace context is restored when switching back
+        crate::task::scheduler::with_scheduler(|sched| {
+            sched.block_current();
+            if let Some(thread) = sched.current_thread_mut() {
+                thread.blocked_in_syscall = true;
+            }
+        });
+
+        // CRITICAL RACE CONDITION FIX:
+        // Check for data AGAIN after setting Blocked state but BEFORE entering HLT.
+        // A packet might have arrived between:
+        //   - when we checked for data (found none)
+        //   - when we set thread state to Blocked
+        // If packet arrived during that window, enqueue_packet() would have tried
+        // to wake us but unblock() would have done nothing (we weren't blocked yet).
+        // Now that we're blocked, check if data arrived and unblock ourselves.
+        // NOTE: Must disable interrupts - has_data() acquires rx_queue lock, same as enqueue_packet()
+        let data_arrived = x86_64::instructions::interrupts::without_interrupts(|| {
+            socket_ref.lock().has_data()
+        });
+        if data_arrived {
+            log::info!("UDP: Thread {} caught race - data arrived during block setup", thread_id);
+            // Data arrived during the race window - unblock and retry
+            crate::task::scheduler::with_scheduler(|sched| {
+                if let Some(thread) = sched.current_thread_mut() {
+                    thread.blocked_in_syscall = false;
+                    thread.set_ready();
+                }
+            });
+            x86_64::instructions::interrupts::without_interrupts(|| {
+                socket_ref.lock().unregister_waiter(thread_id);
+            });
+            continue; // Retry the receive loop
+        }
+
+        // CRITICAL: Re-enable preemption before entering blocking loop!
+        // The syscall handler called preempt_disable() at entry, but we need
+        // to allow timer interrupts to schedule other threads while we're blocked.
+        crate::per_cpu::preempt_enable();
+
+        // HLT loop - wait for timer interrupt which will switch to another thread
+        // When packet arrives via softirq, enqueue_packet() will unblock us
+        loop {
+            crate::task::scheduler::yield_current();
+            x86_64::instructions::interrupts::enable_and_hlt();
+
+            // Check if we were unblocked (thread state changed from Blocked)
+            let still_blocked = crate::task::scheduler::with_scheduler(|sched| {
+                if let Some(thread) = sched.current_thread_mut() {
+                    thread.state == crate::task::thread::ThreadState::Blocked
+                } else {
+                    false
+                }
+            }).unwrap_or(false);
+
+            if !still_blocked {
+                // CRITICAL: Disable preemption BEFORE breaking from HLT loop!
+                // At this point blocked_in_syscall is still true. If we break with
+                // preemption enabled, a timer interrupt could fire and do a context
+                // switch while blocked_in_syscall=true, causing the <B> path to
+                // incorrectly try to restore HLT context when we've already woken.
+                crate::per_cpu::preempt_disable();
+                log::info!("UDP: Thread {} woken from blocking", thread_id);
+                break;
+            }
+            // else: still blocked, continue HLT loop
         }
-    }
 
-    log::debug!("UDP: Received {} bytes from {}.{}.{}.{}:{}",
-        copy_len,
-        packet.src_addr[0], packet.src_addr[1], packet.src_addr[2], packet.src_addr[3],
-        packet.src_port
-    );
+        // NOTE: preempt_disable() is now called inside the HLT loop break path
+        // to close the race window where blocked_in_syscall is true but we've woken.
 
-    SyscallResult::Ok(copy_len as u64)
+        // Clear blocked_in_syscall now that we're resuming normal syscall execution
+        crate::task::scheduler::with_scheduler(|sched| {
+            if let Some(thread) = sched.current_thread_mut() {
+                thread.blocked_in_syscall = false;
+            }
+        });
+
+        // Unregister from wait queue (will re-register at top of loop)
+        x86_64::instructions::interrupts::without_interrupts(|| {
+            socket_ref.lock().unregister_waiter(thread_id);
+        });
+
+        // Drain loopback again before retrying
+        crate::net::drain_loopback_queue();
+
+        // Loop back to try receiving again - we should have data now
+    }
 }
 
 /// sys_listen - Mark a TCP socket as listening for connections
@@ -475,9 +630,8 @@ pub fn sys_listen(fd: u64, backlog: u64) -> SyscallResult {
 pub fn sys_accept(fd: u64, addr_ptr: u64, addrlen_ptr: u64) -> SyscallResult {
     log::debug!("sys_accept: fd={}", fd);
 
-    // Process any pending network packets before checking for connections.
-    // This ensures incoming SYN packets are handled even if IRQ hasn't fired.
-    crate::net::process_rx();
+    // Drain loopback queue for localhost connections (127.x.x.x, own IP).
+    // Hardware-received packets arrive via interrupt → softirq → process_rx().
     crate::net::drain_loopback_queue();
 
     // Get current thread and process
@@ -647,11 +801,11 @@ pub fn sys_connect(fd: u64, addr_ptr: u64, addrlen: u64) -> SyscallResult {
             drop(manager_guard);
 
             // Wait for connection to establish (poll with yields)
+            // SYN-ACK packets arrive via interrupt → softirq → process_rx().
+            // yield_current() triggers scheduling, which allows softirqs to run.
             const MAX_WAIT_ITERATIONS: u32 = 1000;
             for i in 0..MAX_WAIT_ITERATIONS {
-                // Poll for incoming packets (process SYN-ACK)
-                crate::net::process_rx();
-                // Also drain loopback queue for localhost connections
+                // Drain loopback queue for localhost connections (127.x.x.x, own IP)
                 crate::net::drain_loopback_queue();
 
                 // Check if connected
@@ -750,3 +904,110 @@ pub fn sys_shutdown(fd: u64, how: u64) -> SyscallResult {
         _ => SyscallResult::Err(EOPNOTSUPP as u64),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Test that sys_recvfrom returns EBADF for invalid file descriptor
+    ///
+    /// NOTE: This test requires a process context which isn't available in unit tests.
+    /// The error path is validated by verifying the constants are correct.
+    #[test]
+    fn test_recvfrom_error_constants() {
+        // Verify EAGAIN constant for non-blocking mode
+        assert_eq!(EAGAIN, 11);
+
+        // Verify EBADF constant for bad file descriptor
+        assert_eq!(EBADF, 9);
+
+        // Verify ENOTSOCK constant for non-socket fd
+        assert_eq!(ENOTSOCK, 88);
+
+        // Verify EFAULT constant for bad address
+        assert_eq!(EFAULT, 14);
+
+        // Verify EINVAL constant for invalid argument
+        assert_eq!(EINVAL, 22);
+    }
+
+    /// Test that EBADF constant is correct for invalid fd error
+    #[test]
+    fn test_recvfrom_ebadf_constant() {
+        // EBADF (Bad file descriptor) should be returned when recvfrom
+        // is called with an invalid fd. Since sys_recvfrom requires a
+        // process context, we verify the constant is correct.
+        // The actual error path is tested by nonblock_eagain_test.rs
+        // userspace integration test.
+        assert_eq!(EBADF, 9);
+    }
+
+    /// Test SockAddrIn structure layout and conversion
+    #[test]
+    fn test_sockaddr_in_structure() {
+        // Create a sockaddr_in for 192.168.1.1:8080
+        let addr = SockAddrIn::new([192, 168, 1, 1], 8080);
+
+        // Verify family
+        assert_eq!(addr.sin_family, AF_INET);
+
+        // Verify port is in network byte order (big-endian)
+        // 8080 = 0x1F90, network order = [0x1F, 0x90]
+        assert_eq!(addr.sin_port, 8080u16.to_be());
+
+        // Convert to bytes and verify
+        let bytes = addr.to_bytes();
+        assert_eq!(bytes.len(), 16); // sockaddr_in is 16 bytes
+
+        // Check family field (first 2 bytes, little-endian u16)
+        assert_eq!(bytes[0], AF_INET as u8);
+        assert_eq!(bytes[1], 0);
+
+        // Check port field (bytes 2-3, big-endian)
+        assert_eq!(bytes[2], 0x1F); // High byte of 8080
+        assert_eq!(bytes[3], 0x90); // Low byte of 8080
+
+        // Check IP address (bytes 4-7)
+        assert_eq!(bytes[4], 192);
+        assert_eq!(bytes[5], 168);
+        assert_eq!(bytes[6], 1);
+        assert_eq!(bytes[7], 1);
+    }
+
+    /// Test socket type constants
+    #[test]
+    fn test_socket_type_constants() {
+        // Verify socket type constants match POSIX/Linux values
+        assert_eq!(AF_INET, 2);
+        assert_eq!(SOCK_STREAM, 1); // TCP
+        assert_eq!(SOCK_DGRAM, 2);  // UDP
+    }
+
+    /// Test that blocking recvfrom implementation handles race condition check
+    ///
+    /// The race condition fix checks has_data() AFTER setting thread to Blocked state.
+    /// This test verifies the UdpSocket::has_data() method works correctly.
+    #[test]
+    fn test_udp_socket_has_data_for_race_check() {
+        use crate::socket::udp::{UdpSocket, UdpPacket};
+
+        let socket = UdpSocket::new();
+
+        // Initially no data
+        assert!(!socket.has_data());
+
+        // After enqueue, has_data should return true
+        let packet = UdpPacket {
+            src_addr: [127, 0, 0, 1],
+            src_port: 12345,
+            data: alloc::vec![1, 2, 3, 4],
+        };
+        socket.enqueue_packet(packet);
+
+        assert!(socket.has_data());
+
+        // After receiving, no more data
+        let _ = socket.recv_from();
+        assert!(!socket.has_data());
+    }
+}
diff --git a/kernel/src/task/executor.rs b/kernel/src/task/executor.rs
index cf11958d..2320d093 100644
--- a/kernel/src/task/executor.rs
+++ b/kernel/src/task/executor.rs
@@ -3,6 +3,7 @@ use alloc::{collections::BTreeMap, sync::Arc, task::Wake};
 use core::task::{Context, Poll, Waker};
 use crossbeam_queue::ArrayQueue;
 
+#[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
 pub struct Executor {
     tasks: BTreeMap<TaskId, Task>,
     task_queue: Arc<ArrayQueue<TaskId>>,
@@ -10,6 +11,7 @@ pub struct Executor {
 }
 
 impl Executor {
+    #[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
     pub fn new() -> Self {
         Executor {
             tasks: BTreeMap::new(),
@@ -18,6 +20,7 @@ impl Executor {
         }
     }
 
+    #[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
     pub fn spawn(&mut self, task: Task) {
         let task_id = task.id;
         if self.tasks.insert(task.id, task).is_some() {
@@ -26,6 +29,7 @@ impl Executor {
         self.task_queue.push(task_id).expect("queue full");
     }
 
+    #[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
     fn run_ready_tasks(&mut self) {
         // destructure `self` to avoid borrow checker errors
         let Self {
@@ -54,6 +58,7 @@ impl Executor {
         }
     }
 
+    #[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
     fn sleep_if_idle(&self) {
         use x86_64::instructions::interrupts;
 
@@ -66,6 +71,7 @@ impl Executor {
         }
     }
 
+    #[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
     pub fn run(&mut self) -> ! {
         loop {
             self.run_ready_tasks();
@@ -74,12 +80,14 @@ impl Executor {
     }
 }
 
+#[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
 struct TaskWaker {
     task_id: TaskId,
     task_queue: Arc<ArrayQueue<TaskId>>,
 }
 
 impl TaskWaker {
+    #[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
     fn new(task_id: TaskId, task_queue: Arc<ArrayQueue<TaskId>>) -> Waker {
         Waker::from(Arc::new(TaskWaker {
             task_id,
@@ -87,6 +95,7 @@ impl TaskWaker {
         }))
     }
 
+    #[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
     fn wake_task(&self) {
         self.task_queue.push(self.task_id).expect("task_queue full");
     }
diff --git a/kernel/src/task/mod.rs b/kernel/src/task/mod.rs
index 175475d1..191e225d 100644
--- a/kernel/src/task/mod.rs
+++ b/kernel/src/task/mod.rs
@@ -39,22 +39,26 @@ pub use softirqd::{
     SoftirqType,
 };
 
+#[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
 #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
 pub struct TaskId(u64);
 
 impl TaskId {
+    #[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
     fn new() -> Self {
         static NEXT_ID: AtomicU64 = AtomicU64::new(0);
         TaskId(NEXT_ID.fetch_add(1, Ordering::Relaxed))
     }
 }
 
+#[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
 pub struct Task {
     id: TaskId,
     future: Pin<Box<dyn Future<Output = ()>>>,
 }
 
 impl Task {
+    #[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
     pub fn new(future: impl Future<Output = ()> + 'static) -> Task {
         Task {
             id: TaskId::new(),
@@ -62,6 +66,7 @@ impl Task {
         }
     }
 
+    #[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
     fn poll(&mut self, context: &mut Context) -> Poll<()> {
         self.future.as_mut().poll(context)
     }
diff --git a/kernel/src/task/scheduler.rs b/kernel/src/task/scheduler.rs
index 5ca5369f..20be0f6b 100644
--- a/kernel/src/task/scheduler.rs
+++ b/kernel/src/task/scheduler.rs
@@ -116,7 +116,10 @@ impl Scheduler {
                     };
 
                 // Put non-terminated, non-blocked threads back in ready queue
-                if !is_terminated && !is_blocked {
+                // CRITICAL: Check for duplicates! If unblock() already added this thread
+                // (e.g., packet arrived during blocking recvfrom), don't add it again.
+                // Duplicates cause schedule() to spin when same thread keeps getting selected.
+                if !is_terminated && !is_blocked && !self.ready_queue.contains(&current_id) {
                     self.ready_queue.push_back(current_id);
                 }
             }
@@ -619,6 +622,85 @@ pub fn switch_to_idle() {
 #[cfg(test)]
 pub mod tests {
     use super::*;
+    use alloc::boxed::Box;
+    use alloc::string::String;
+    use crate::task::thread::{Thread, ThreadPrivilege, ThreadState};
+    use x86_64::VirtAddr;
+
+    fn dummy_entry() {}
+
+    fn make_thread(id: u64, state: ThreadState) -> Box<Thread> {
+        let mut thread = Thread::new_with_id(
+            id,
+            String::from("scheduler-test-thread"),
+            dummy_entry,
+            VirtAddr::new(0x2000),
+            VirtAddr::new(0x1000),
+            VirtAddr::new(0),
+            ThreadPrivilege::Kernel,
+        );
+        thread.state = state;
+        Box::new(thread)
+    }
+
+    pub fn test_unblock_does_not_duplicate_ready_queue() {
+        log::info!("=== TEST: unblock avoids duplicate ready_queue entries ===");
+
+        let idle_thread = make_thread(1, ThreadState::Ready);
+        let mut scheduler = Scheduler::new(idle_thread);
+
+        let blocked_thread_id = 2;
+        let blocked_thread = make_thread(blocked_thread_id, ThreadState::Blocked);
+        scheduler.add_thread(blocked_thread);
+        if let Some(thread) = scheduler.get_thread_mut(blocked_thread_id) {
+            thread.state = ThreadState::Blocked;
+        }
+        scheduler.remove_from_ready_queue(blocked_thread_id);
+
+        scheduler.unblock(blocked_thread_id);
+        scheduler.unblock(blocked_thread_id);
+
+        let count = scheduler
+            .ready_queue
+            .iter()
+            .filter(|&&id| id == blocked_thread_id)
+            .count();
+        assert_eq!(count, 1);
+
+        log::info!("=== TEST PASSED: unblock avoids duplicate ready_queue entries ===");
+    }
+
+    pub fn test_schedule_does_not_duplicate_ready_queue() {
+        log::info!("=== TEST: schedule avoids duplicate ready_queue entries ===");
+
+        let idle_thread = make_thread(1, ThreadState::Ready);
+        let mut scheduler = Scheduler::new(idle_thread);
+
+        let current_thread_id = 2;
+        let current_thread = make_thread(current_thread_id, ThreadState::Running);
+        scheduler.add_thread(current_thread);
+
+        let other_thread_id = 3;
+        let other_thread = make_thread(other_thread_id, ThreadState::Ready);
+        scheduler.add_thread(other_thread);
+
+        scheduler.current_thread = Some(current_thread_id);
+        if let Some(thread) = scheduler.get_thread_mut(current_thread_id) {
+            thread.state = ThreadState::Running;
+        }
+
+        let scheduled = scheduler.schedule();
+        assert_eq!(scheduled.is_some(), true);
+
+        let count = scheduler
+            .ready_queue
+            .iter()
+            .filter(|&&id| id == current_thread_id)
+            .count();
+        assert_eq!(count, 1);
+
+        log::info!("=== TEST PASSED: schedule avoids duplicate ready_queue entries ===");
+    }
 
     /// Test that yield_current() does NOT modify scheduler.current_thread.
     ///
diff --git a/kernel/src/time/mod.rs b/kernel/src/time/mod.rs
index 6cdb420c..6dd27eae 100644
--- a/kernel/src/time/mod.rs
+++ b/kernel/src/time/mod.rs
@@ -61,6 +61,7 @@ pub fn current_unix_time() -> i64 {
 }
 
 /// Display comprehensive time debug information
+#[allow(dead_code)] // Used in keyboard_task (conditionally compiled)
 pub fn debug_time_info() {
     log::info!("=== Time Debug Information ===");
 
diff --git a/kernel/src/time/timer.rs b/kernel/src/time/timer.rs
index e8a34d3a..1dffe031 100644
--- a/kernel/src/time/timer.rs
+++ b/kernel/src/time/timer.rs
@@ -97,6 +97,7 @@ pub fn get_monotonic_time_ns() -> (u64, u64) {
 
 /// Validate that the PIT hardware is configured and counting
 /// Returns (is_counting, count1, count2, description)
+#[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
 pub fn validate_pit_counting() -> (bool, u16, u16, &'static str) {
     unsafe {
         let mut ch0: Port<u8> = Port::new(PIT_CHANNEL0_PORT);
diff --git a/kernel/src/time/tsc.rs b/kernel/src/time/tsc.rs
index e97537a4..635e3cec 100644
--- a/kernel/src/time/tsc.rs
+++ b/kernel/src/time/tsc.rs
@@ -40,12 +40,14 @@ pub fn calibrate() {
 
 /// Check if TSC has been calibrated
 #[inline]
+#[allow(dead_code)] // Used in tests and debug_time_info (conditionally compiled)
 pub fn is_calibrated() -> bool {
     hal_timer::is_calibrated()
 }
 
 /// Get TSC frequency in Hz
 #[inline]
+#[allow(dead_code)] // Used in tests and debug_time_info (conditionally compiled)
 pub fn frequency_hz() -> u64 {
     hal_timer::frequency_hz()
 }
@@ -55,6 +57,7 @@ pub fn frequency_hz() -> u64 {
 /// This provides nanosecond-precision monotonic time based on TSC.
 /// Returns None if TSC hasn't been calibrated yet.
 #[inline]
+#[allow(dead_code)] // Used in debug_time_info (conditionally compiled)
 pub fn nanoseconds_since_base() -> Option<u64> {
     hal_timer::nanoseconds_since_base()
 }
diff --git a/kernel/src/time_test.rs b/kernel/src/time_test.rs
index 39421c10..1a18dbe8 100644
--- a/kernel/src/time_test.rs
+++ b/kernel/src/time_test.rs
@@ -21,6 +21,7 @@
 ///
 /// IMPORTANT: This test runs BEFORE interrupts are enabled, so we cannot wait
 /// for ticks to increment. Instead, we validate the conversion math is correct.
+#[allow(dead_code)] // Used in kernel_main_continue (conditionally compiled)
 pub fn test_timer_resolution() {
     log::info!("=== TIMER RESOLUTION TEST ===");
 
diff --git a/kernel/src/tty/driver.rs b/kernel/src/tty/driver.rs
index 908dbe85..36dfdb69 100644
--- a/kernel/src/tty/driver.rs
+++ b/kernel/src/tty/driver.rs
@@ -121,6 +121,7 @@ impl TtyDevice {
     ///
     /// This method acquires locks and should not be called from interrupt context
     /// without care. For interrupt context, use `input_char_nonblock`.
+    #[allow(dead_code)] // Used by push_char in keyboard_task (conditionally compiled)
     pub fn input_char(&self, c: u8) {
         let mut ldisc = self.ldisc.lock();
 
@@ -327,6 +328,7 @@ impl TtyDevice {
     /// This writes to serial immediately and queues for deferred framebuffer rendering.
     /// The render queue is drained by a dedicated kernel task with its own stack,
     /// avoiding the stack overflow that occurred with direct framebuffer calls.
+    #[allow(dead_code)] // Used by input_char (conditionally compiled)
     pub fn output_char(&self, c: u8) {
         // Handle NL -> CR-NL translation if ONLCR is set
         let termios = self.ldisc.lock().termios().clone();
@@ -417,6 +419,7 @@ impl TtyDevice {
     ///
     /// This is called when the line discipline generates a signal
     /// (e.g., SIGINT from Ctrl+C).
+    #[allow(dead_code)] // Used by input_char (conditionally compiled) and tests
     pub fn send_signal_to_foreground(&self, sig: u32) {
         let pgrp = match *self.foreground_pgrp.lock() {
             Some(pgrp) => pgrp,
@@ -476,6 +479,7 @@ impl TtyDevice {
     }
 
     /// Send a signal to a specific process
+    #[allow(dead_code)] // Used by send_signal_to_foreground (conditionally compiled) and tests
     fn send_signal_to_process(pid: ProcessId, sig: u32) {
         // In test mode, record the signal delivery attempt
         #[cfg(test)]
@@ -607,6 +611,7 @@ impl TtyDevice {
     /// Wake all blocked readers
     ///
     /// This is called when new input is available.
+    #[allow(dead_code)] // Used by input_char (conditionally compiled)
     fn wake_blocked_readers() {
         let mut readers = BLOCKED_READERS.lock();
         while let Some(thread_id) = readers.pop_front() {
@@ -657,6 +662,7 @@ pub fn console() -> Option<Arc<TtyDevice>> {
 ///
 /// This is the main entry point for keyboard input.
 /// It processes the character through the line discipline.
+#[allow(dead_code)] // Used by keyboard_task (conditionally compiled)
 pub fn push_char(c: u8) {
     if let Some(tty) = console() {
         tty.input_char(c);
diff --git a/libs/libbreenix/src/dns.rs b/libs/libbreenix/src/dns.rs
index 5eb05c1a..350e339d 100644
--- a/libs/libbreenix/src/dns.rs
+++ b/libs/libbreenix/src/dns.rs
@@ -15,7 +15,9 @@
 //! ```
 
 use crate::io::close;
+use crate::process::yield_now;
 use crate::socket::{bind, recvfrom, sendto, socket, SockAddrIn, AF_INET, SOCK_DGRAM};
+use crate::time::now_monotonic;
 
 // ============================================================================
 // Constants
@@ -508,13 +510,19 @@ pub fn resolve(hostname: &str, dns_server: [u8; 4]) -> Result<DnsResult, DnsErro
         return Err(DnsError::SendError);
     }
 
-    // Receive response (with retry)
+    // Receive response with 5-second timeout
     let mut resp_buf = [0u8; DNS_BUF_SIZE];
     let mut received = false;
     let mut resp_len = 0;
 
-    // Try up to 5 times with spin-wait
-    for _ in 0..5 {
+    // Network packets arrive via interrupt → softirq → process_rx().
+    // We poll recvfrom() with yield_now() between attempts.
+    // DNS resolution via QEMU SLIRP forwards to host DNS, which can take time.
+    const TIMEOUT_SECS: u64 = 5;
+    let start = now_monotonic();
+    let deadline_secs = start.tv_sec as u64 + TIMEOUT_SECS;
+
+    loop {
         match recvfrom(fd, &mut resp_buf, None) {
             Ok(len) if len > 0 => {
                 resp_len = len;
@@ -522,10 +530,13 @@ pub fn resolve(hostname: &str, dns_server: [u8; 4]) -> Result<DnsResult, DnsErro
                 break;
             }
             _ => {
-                // Brief delay before retry (spin loop)
-                for _ in 0..200000 {
-                    core::hint::spin_loop();
+                // Check timeout
+                let now = now_monotonic();
+                if now.tv_sec as u64 >= deadline_secs {
+                    break; // Timeout
                 }
+                // Yield to scheduler - allows timer interrupt to fire and process softirqs
+                yield_now();
             }
         }
     }
diff --git a/libs/libbreenix/src/socket.rs b/libs/libbreenix/src/socket.rs
index 38d68db7..90633f37 100644
--- a/libs/libbreenix/src/socket.rs
+++ b/libs/libbreenix/src/socket.rs
@@ -30,6 +30,9 @@ pub const SOCK_STREAM: i32 = 1;
 /// Socket type: Datagram (UDP)
 pub const SOCK_DGRAM: i32 = 2;
 
+/// Socket flag: Non-blocking
+pub const SOCK_NONBLOCK: i32 = 0x800;
+
 /// Shutdown how: Stop receiving
 pub const SHUT_RD: i32 = 0;
 
diff --git a/userspace/tests/Cargo.toml b/userspace/tests/Cargo.toml
index ba0ed3e0..1e112868 100644
--- a/userspace/tests/Cargo.toml
+++ b/userspace/tests/Cargo.toml
@@ -162,6 +162,14 @@ path = "signal_regs_test.rs"
 name = "udp_socket_test"
 path = "udp_socket_test.rs"
 
+[[bin]]
+name = "blocking_recv_test"
+path = "blocking_recv_test.rs"
+
+[[bin]]
+name = "nonblock_eagain_test"
+path = "nonblock_eagain_test.rs"
+
 [[bin]]
 name = "tcp_socket_test"
 path = "tcp_socket_test.rs"
diff --git a/userspace/tests/blocking_recv_test.rs b/userspace/tests/blocking_recv_test.rs
new file mode 100644
index 00000000..e9ac9e86
--- /dev/null
+++ b/userspace/tests/blocking_recv_test.rs
@@ -0,0 +1,122 @@
+//! Blocking recvfrom() test
+//!
+//! Verifies that a blocking UDP recvfrom() waits for data and wakes on packet.
+
+#![no_std]
+#![no_main]
+
+use core::panic::PanicInfo;
+use libbreenix::io;
+use libbreenix::process;
+use libbreenix::socket::{bind, recvfrom, socket, SockAddrIn, AF_INET, SOCK_DGRAM};
+
+#[no_mangle]
+pub extern "C" fn _start() -> ! {
+    io::print("BLOCKING_RECV_TEST: starting\n");
+
+    let fd = match socket(AF_INET, SOCK_DGRAM, 0) {
+        Ok(fd) => fd,
+        Err(e) => {
+            io::print("BLOCKING_RECV_TEST: socket failed, errno=");
+            print_num(e as u64);
+            io::print("\n");
+            process::exit(1);
+        }
+    };
+
+    let local_addr = SockAddrIn::new([0, 0, 0, 0], 55556);
+    match bind(fd, &local_addr) {
+        Ok(()) => {}
+        Err(e) => {
+            io::print("BLOCKING_RECV_TEST: bind failed, errno=");
+            print_num(e as u64);
+            io::print("\n");
+            process::exit(2);
+        }
+    }
+
+    io::print("BLOCKING_RECV_TEST: waiting for packet...\n");
+
+    let mut recv_buf = [0u8; 256];
+    let mut src_addr = SockAddrIn::new([0, 0, 0, 0], 0);
+    match recvfrom(fd, &mut recv_buf, Some(&mut src_addr)) {
+        Ok(bytes) => {
+            io::print("BLOCKING_RECV_TEST: received ");
+            print_num(bytes as u64);
+            io::print(" bytes from ");
+            print_ip(src_addr.addr);
+            io::print(":");
+            print_num(src_addr.port_host() as u64);
+            io::print("\n");
+
+            let expected = b"wakeup";
+            let mut matches = bytes >= expected.len();
+            if matches {
+                for i in 0..expected.len() {
+                    if recv_buf[i] != expected[i] {
+                        matches = false;
+                        break;
+                    }
+                }
+            }
+
+            if matches {
+                io::print("BLOCKING_RECV_TEST: data verified\n");
+            } else {
+                io::print("BLOCKING_RECV_TEST: data mismatch\n");
+                process::exit(4);
+            }
+        }
+        Err(e) => {
+            io::print("BLOCKING_RECV_TEST: recvfrom failed, errno=");
+            print_num(e as u64);
+            io::print("\n");
+            process::exit(3);
+        }
+    }
+
+    io::print("BLOCKING_RECV_TEST: PASS\n");
+    io::close(fd as u64);
+    process::exit(0);
+}
+
+fn print_ip(addr: [u8; 4]) {
+    print_num(addr[0] as u64);
+    io::print(".");
+    print_num(addr[1] as u64);
+    io::print(".");
+    print_num(addr[2] as u64);
+    io::print(".");
+    print_num(addr[3] as u64);
+}
+
+/// Simple number printing (no formatting)
+fn print_num(mut n: u64) {
+    if n == 0 {
+        io::print("0");
+        return;
+    }
+
+    let mut buf = [0u8; 20];
+    let mut i = 0;
+
+    while n > 0 {
+        buf[i] = b'0' + (n % 10) as u8;
+        n /= 10;
+        i += 1;
+    }
+
+    while i > 0 {
+        i -= 1;
+        let ch = [buf[i]];
+        if let Ok(s) = core::str::from_utf8(&ch) {
+            io::print(s);
+        }
+    }
+}
+
+#[panic_handler]
+fn panic(_info: &PanicInfo) -> ! {
+    io::print("BLOCKING_RECV_TEST: PANIC!\n");
+    process::exit(99);
+}
diff --git a/userspace/tests/build.sh b/userspace/tests/build.sh
index 5bd7c81b..dce61794 100755
--- a/userspace/tests/build.sh
+++ b/userspace/tests/build.sh
@@ -48,6 +48,8 @@ BINARIES=(
     "signal_return_test"
     "signal_regs_test"
     "udp_socket_test"
+    "blocking_recv_test"
+    "nonblock_eagain_test"
     "tcp_socket_test"
     "tcp_client_test"
     "dns_test"
diff --git a/userspace/tests/nonblock_eagain_test.rs b/userspace/tests/nonblock_eagain_test.rs
new file mode 100644
index 00000000..f763405b
--- /dev/null
+++ b/userspace/tests/nonblock_eagain_test.rs
@@ -0,0 +1,97 @@
+//! Non-blocking recvfrom() EAGAIN test
+//!
+//! Verifies that a non-blocking UDP recvfrom() returns EAGAIN when no data.
+
+#![no_std]
+#![no_main]
+
+use core::panic::PanicInfo;
+use libbreenix::io;
+use libbreenix::process;
+use libbreenix::socket::{
+    bind, recvfrom, socket, SockAddrIn, AF_INET, SOCK_DGRAM, SOCK_NONBLOCK,
+};
+
+#[no_mangle]
+pub extern "C" fn _start() -> ! {
+    io::print("NONBLOCK_EAGAIN_TEST: starting\n");
+
+    let fd = match socket(AF_INET, SOCK_DGRAM | SOCK_NONBLOCK, 0) {
+        Ok(fd) => fd,
+        Err(e) => {
+            io::print("NONBLOCK_EAGAIN_TEST: socket failed, errno=");
+            print_num(e as u64);
+            io::print("\n");
+            process::exit(1);
+        }
+    };
+
+    let local_addr = SockAddrIn::new([0, 0, 0, 0], 55557);
+    match bind(fd, &local_addr) {
+        Ok(()) => {}
+        Err(e) => {
+            io::print("NONBLOCK_EAGAIN_TEST: bind failed, errno=");
+            print_num(e as u64);
+            io::print("\n");
+            process::exit(2);
+        }
+    }
+
+    io::print("NONBLOCK_EAGAIN_TEST: recvfrom with empty queue...\n");
+
+    let mut recv_buf = [0u8; 256];
+    let mut src_addr = SockAddrIn::new([0, 0, 0, 0], 0);
+    match recvfrom(fd, &mut recv_buf, Some(&mut src_addr)) {
+        Ok(bytes) => {
+            io::print("NONBLOCK_EAGAIN_TEST: unexpected data, bytes=");
+            print_num(bytes as u64);
+            io::print("\n");
+            process::exit(3);
+        }
+        Err(e) => {
+            if e == 11 {
+                io::print("NONBLOCK_EAGAIN_TEST: got EAGAIN\n");
+            } else {
+                io::print("NONBLOCK_EAGAIN_TEST: expected EAGAIN, errno=");
+                print_num(e as u64);
+                io::print("\n");
+                process::exit(4);
+            }
+        }
+    }
+
+    io::print("NONBLOCK_EAGAIN_TEST: PASS\n");
+    io::close(fd as u64);
+    process::exit(0);
+}
+
+/// Simple number printing (no formatting)
+fn print_num(mut n: u64) {
+    if n == 0 {
+        io::print("0");
+        return;
+    }
+
+    let mut buf = [0u8; 20];
+    let mut i = 0;
+
+    while n > 0 {
+        buf[i] = b'0' + (n % 10) as u8;
+        n /= 10;
+        i += 1;
+    }
+
+    while i > 0 {
+        i -= 1;
+        let ch = [buf[i]];
+        if let Ok(s) = core::str::from_utf8(&ch) {
+            io::print(s);
+        }
+    }
+}
+
+#[panic_handler]
+fn panic(_info: &PanicInfo) -> ! {
+    io::print("NONBLOCK_EAGAIN_TEST: PANIC!\n");
+    process::exit(99);
+}
diff --git a/userspace/tests/udp_socket_test.rs b/userspace/tests/udp_socket_test.rs
index 830065d7..1907f298 100644
--- a/userspace/tests/udp_socket_test.rs
+++ b/userspace/tests/udp_socket_test.rs
@@ -19,7 +19,7 @@
 use core::panic::PanicInfo;
 use libbreenix::io;
 use libbreenix::process;
-use libbreenix::socket::{socket, bind, sendto, recvfrom, SockAddrIn, AF_INET, SOCK_DGRAM};
+use libbreenix::socket::{socket, bind, sendto, recvfrom, SockAddrIn, AF_INET, SOCK_DGRAM, SOCK_NONBLOCK};
 
 #[no_mangle]
 pub extern "C" fn _start() -> ! {
@@ -278,7 +278,7 @@ pub extern "C" fn _start() -> ! {
     // EAGAIN = 11 (Linux)
     const EAGAIN: i32 = 11;
 
-    let eagain_fd = match socket(AF_INET, SOCK_DGRAM, 0) {
+    let eagain_fd = match socket(AF_INET, SOCK_DGRAM | SOCK_NONBLOCK, 0) {
         Ok(fd) => fd,
         Err(e) => {
             io::print("UDP EAGAIN Test: FAILED to create socket, errno=");
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index aecbc2cc..c325d121 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -190,6 +190,8 @@ enum Cmd {
     InteractiveTest,
     /// Run kthread stress test (100+ kthreads, rapid create/stop cycles).
     KthreadStress,
+    /// Run focused DNS test only (faster iteration for network debugging).
+    DnsTest,
 }
 
 fn main() -> Result<()> {
@@ -201,6 +203,7 @@ fn main() -> Result<()> {
         Cmd::Interactive => interactive(),
         Cmd::InteractiveTest => interactive_test(),
         Cmd::KthreadStress => kthread_stress(),
+        Cmd::DnsTest => dns_test(),
     }
 }
 
@@ -1869,6 +1872,228 @@ fn get_boot_stages() -> Vec<BootStage> {
     ]
 }
 
+/// Get DNS-specific boot stages for focused testing with dns_test_only feature
+fn get_dns_stages() -> Vec<BootStage> {
+    vec![
+        // DNS_TEST_ONLY mode markers
+        BootStage {
+            name: "DNS test only mode started",
+            marker: "DNS_TEST_ONLY: Starting minimal DNS test",
+            failure_meaning: "Kernel didn't enter dns_test_only mode",
+            check_hint: "Check kernel/src/main.rs dns_test_only_main() is being called",
+        },
+        BootStage {
+            name: "DNS test process created",
+            marker: "DNS_TEST_ONLY: Created dns_test process",
+            failure_meaning: "Failed to create dns_test process",
+            check_hint: "Check kernel/src/main.rs dns_test_only_main() create_user_process",
+        },
+        // DNS test userspace markers (go to COM1)
+        BootStage {
+            name: "DNS test starting",
+            marker: "DNS Test: Starting",
+            failure_meaning: "DNS test binary did not start executing",
+            check_hint: "Check scheduler is running userspace, check userspace/tests/dns_test.rs",
+        },
+        BootStage {
+            name: "DNS google resolve",
+            marker: "DNS_TEST: google_resolve OK",
+            failure_meaning: "DNS resolution of www.google.com failed",
+            check_hint: "Check libs/libbreenix/src/dns.rs:resolve() and UDP socket/softirq path",
+        },
+        BootStage {
+            name: "DNS example resolve",
+            marker: "DNS_TEST: example_resolve OK",
+            failure_meaning: "DNS resolution of example.com failed",
+            check_hint: "Check libs/libbreenix/src/dns.rs - may be DNS server or parsing issue",
+        },
+        BootStage {
+            name: "DNS test completed",
+            marker: "DNS Test: All tests passed",
+            failure_meaning: "DNS test did not complete all tests",
+            check_hint: "Check userspace/tests/dns_test.rs for which step failed",
+        },
+    ]
+}
+
+/// Focused DNS test - only checks DNS-related boot stages
+/// Much faster iteration than full boot_stages when debugging network issues
+fn dns_test() -> Result<()> {
+    let stages = get_dns_stages();
+    let total_stages = stages.len();
+
+    println!("DNS Test - {} stages to check", total_stages);
+    println!("=========================================\n");
+
+    // Build std test binaries BEFORE creating the test disk
+    build_std_test_binaries()?;
+
+    // Create the test disk with all userspace binaries
+    test_disk::create_test_disk()?;
+    println!();
+
+    // COM2 (log output) - this is where all test markers go
+    let serial_output_file = "target/xtask_dns_test_output.txt";
+    // COM1 (user output) - raw userspace output
+    let user_output_file = "target/xtask_dns_user_output.txt";
+
+    // Remove old output files
+    let _ = fs::remove_file(serial_output_file);
+    let _ = fs::remove_file(user_output_file);
+
+    // Kill any existing QEMU for THIS worktree only
+    kill_worktree_qemu();
+    thread::sleep(Duration::from_millis(500));
+
+    println!("Starting QEMU for DNS test...\n");
+
+    // Start QEMU with dns_test_only feature (skips all other tests)
+    let mut child = Command::new("cargo")
+        .args(&[
+            "run",
+            "--release",
+            "-p",
+            "breenix",
+            "--features",
+            "dns_test_only",  // Uses minimal boot path
+            "--bin",
+            "qemu-uefi",
+            "--",
+            "-serial",
+            &format!("file:{}", user_output_file),
+            "-serial",
+            &format!("file:{}", serial_output_file),
+            "-display",
+            "none",
+        ])
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::inherit())
+        .spawn()
+        .map_err(|e| anyhow::anyhow!("Failed to spawn QEMU: {}", e))?;
+
+    save_qemu_pid(child.id());
+
+    // Wait for output file to be created
+    let start = Instant::now();
+    let file_creation_timeout = Duration::from_secs(60);
+
+    while !std::path::Path::new(serial_output_file).exists() {
+        if start.elapsed() > file_creation_timeout {
+            cleanup_qemu_child(&mut child);
+            bail!("Serial output file not created after {} seconds", file_creation_timeout.as_secs());
+        }
+        thread::sleep(Duration::from_millis(100));
+    }
+
+    // Track which stages have passed
+    let mut stages_passed = 0;
+    let mut last_content_len = 0;
+    let mut checked_stages: Vec<bool> = vec![false; total_stages];
+
+    let test_start = Instant::now();
+    // With dns_test_only feature, only essential boot + DNS test runs
+    // Should complete in under 30 seconds
+    let timeout = Duration::from_secs(60);
+
+    loop {
+        // Check timeout
+        if test_start.elapsed() > timeout {
+            cleanup_qemu_child(&mut child);
+            println!("\n=========================================");
+            println!("Result: {}/{} stages passed (TIMEOUT after {}s)", stages_passed, total_stages, timeout.as_secs());
+            if stages_passed < total_stages {
+                // Find first unpassed stage
+                for (i, passed) in checked_stages.iter().enumerate() {
+                    if !passed {
+                        println!("\nFirst failed stage: [{}] {}", i + 1, stages[i].name);
+                        println!("  Meaning: {}", stages[i].failure_meaning);
+                        println!("  Check:   {}", stages[i].check_hint);
+                        break;
+                    }
+                }
+                bail!("DNS test incomplete - timeout");
+            }
+            break;
+        }
+
+        // Check if QEMU exited
+        match child.try_wait() {
+            Ok(Some(status)) => {
+                // QEMU exited - do final check of both output files
+                thread::sleep(Duration::from_millis(100));
+                let kernel_content = fs::read_to_string(serial_output_file).unwrap_or_default();
+                let user_content = fs::read_to_string(user_output_file).unwrap_or_default();
+                for (i, stage) in stages.iter().enumerate() {
+                    if !checked_stages[i] {
+                        if kernel_content.contains(stage.marker) || user_content.contains(stage.marker) {
+                            checked_stages[i] = true;
+                            stages_passed += 1;
+                            println!("[{}/{}] {}... PASS", i + 1, total_stages, stage.name);
+                        }
+                    }
+                }
+                println!("\n=========================================");
+                if stages_passed == total_stages {
+                    println!("Result: ALL {}/{} stages passed (total: {:.2}s)", stages_passed, total_stages, test_start.elapsed().as_secs_f64());
+                    return Ok(());
+                } else {
+                    println!("Result: {}/{} stages passed (QEMU exit code: {:?})", stages_passed, total_stages, status.code());
+                    for (i, passed) in checked_stages.iter().enumerate() {
+                        if !passed {
+                            println!("\nFirst failed stage: [{}] {}", i + 1, stages[i].name);
+                            println!("  Meaning: {}", stages[i].failure_meaning);
+                            println!("  Check:   {}", stages[i].check_hint);
+                            break;
+                        }
+                    }
+                    bail!("DNS test failed");
+                }
+            }
+            Ok(None) => {
+                // Still running
+            }
+            Err(e) => {
+                bail!("Failed to check QEMU status: {}", e);
+            }
+        }
+
+        // Read and check for markers from BOTH output files
+        // - COM2 (kernel log): ARP and softirq markers
+        // - COM1 (user output): DNS test markers (userspace prints to stdout -> COM1)
+        let kernel_content = fs::read_to_string(serial_output_file).unwrap_or_default();
+        let user_content = fs::read_to_string(user_output_file).unwrap_or_default();
+        let combined_len = kernel_content.len() + user_content.len();
+
+        if combined_len > last_content_len {
+            last_content_len = combined_len;
+
+            // Check all stages against both output sources
+            for (i, stage) in stages.iter().enumerate() {
+                if !checked_stages[i] {
+                    if kernel_content.contains(stage.marker) || user_content.contains(stage.marker) {
+                        checked_stages[i] = true;
+                        stages_passed += 1;
+                        println!("[{}/{}] {}... PASS", i + 1, total_stages, stage.name);
+                    }
+                }
+            }
+
+            // If all stages passed, we're done
+            if stages_passed == total_stages {
+                cleanup_qemu_child(&mut child);
+                println!("\n=========================================");
+                println!("Result: ALL {}/{} stages passed (total: {:.2}s)", stages_passed, total_stages, test_start.elapsed().as_secs_f64());
+                return Ok(());
+            }
+        }
+
+        thread::sleep(Duration::from_millis(100));
+    }
+
+    Ok(())
+}
+
 /// Boot kernel once and validate each stage with real-time output
 ///
 /// Uses dual serial port configuration: