# DF-0824: ext2_checkpath infinite loop on crafted cyclic .. directory entries

**Severity:** Medium — local DoS via crafted ext2 image (uninterruptible kernel hang)
**CWE:** CWE-835 (Infinite Loop)
**Status:** REPRODUCED on unpatched `#0`; FIX VALIDATED (single-file module rebuild).

## Summary

`ext2_checkpath()` (`sys/vfs/ext2fs/ext2_lookup.c:1212-1241`) walks a target
directory's `..` parent chain in an unbounded `for(;;)` loop with no depth
limit, no cycle detection, and no signal-pending check. A crafted ext2 image
with cyclic `..` entries (A→B→A) makes it loop forever when a directory is
renamed into the cyclic parent. The kernel thread spins at 100% CPU and
**cannot be killed by SIGKILL**.

## Reproduce

The image must be crafted offline (impossible via online mkdir/rename). On a
Linux host with e2fsprogs:

```sh
python3 craft_img.py     # produces df0824.img (1MB ext2, A<->B .. cycle)
scp df0824.img run.sh dfbsd:/root/
ssh dfbsd
sh /root/run.sh          # as root
```

| Kernel | Result |
|--------|--------|
| Unpatched `#0` | `mv S A/S_moved` hangs forever; kernel thread R3 @ 100% CPU, SIGKILL-proof |
| Fixed ext2fs.ko | `mv: rename S to A/S_moved: Invalid argument`; returns in 0s |

See `VERDICT.md` for the full mechanism, `run.log` for baseline proof,
`fix_run.log` for the fixed-kernel proof, and `fix.diff` for the patch.