# DF-0990 — PCI capability-list walk has no cycle detection

## Summary
`pci_read_capabilities()` at `sys/bus/pci/pci.c:847` walks the PCI cap
list following next-pointers from device config space. `pci_fixup_nextptr()`
at `pci.c:601` returns 1 for every `nextptr ∈ [0x40, 0xff]` — there is
NO iteration counter and NO visited-set. A malicious PCI device with a
self-loop in its cap list (e.g. cap@0x80 next=0x80) causes an infinite
spin doing config reads at full CPU speed → boot-time DoS.

**Reachability:** Requires a malicious PCI device (physical card with
malicious firmware, or a malicious hypervisor emulating one). The QEMU
guest's virtual PCI devices all present well-formed cap lists. Not
triggerable by an unprivileged user.

## Files
- `fix.diff` — git-apply-able fix: add 64-iteration cap to detect cycles
- `fix_build.log` — kernel build output showing `pci.c` compiles cleanly
  under `-Werror` with the fix applied (NK_DONE rc=0)
- `env.txt` — guest environment
- `VERDICT.md` — detailed analysis
- `manifest.json` — artifact catalog

## Reproduce
No runtime reproduction possible (requires malicious PCI hardware). To
rebuild the patched kernel:
```sh
scp fix.diff dfbsd:/root/fix.diff
ssh dfbsd '/bin/sh -c "cd /usr/src && patch -p1 --forward < /root/fix.diff && make -j6 nativekernel KERNCONF=X86_64_GENERIC"'
```