ptrace attach in multi-threaded processes

Hi,

It seems to be possible for ptrace(PT_ATTACH) to race with the delivery
of a signal to the same process. ptrace(PT_ATTACH) sets P_TRACED and
sends SIGSTOP to a thread in the target process. Consider the case where
a signal is delivered to a second thread, and both threads are executing
ast() concurrently. The two threads will both call issignal() and from
there call ptracestop() because P_TRACED is set, though they will be
serialized by the proc lock. If the thread receiving SIGSTOP wins the
race, it will suspend first and set p->p_xthread. The second thread will
also suspend in ptracestop(), overwriting the p_xthread field set by the
first thread. Later, ptrace(PT_DETACH) will unsuspend the threads, but
it will set td->td_xsig only in the second thread. This means that the
first thread will return SIGSTOP from ptracestop() and subsequently
suspend the process, which seems rather incorrect.

The above is just a theory to explain an unexpectedly-stopped
multi-threaded process that I've observed. Is there some mechanism I'm
missing that prevents multiple threads from suspending in ptracestop()
at the same time? If not, then I think that's the root of the problem,
since p_xthread is pretty clearly not meant to be overwritten this way.
Moreover, in my scenario I see a thread with TDB_XSIG set even after
ptrace(PT_DETACH) was called (P_TRACED is cleared).

Thanks,
-Mark