# DF-1126 — Infinite loop in isp_intr response-queue processing (SCSI target mode)

## Finding
`isp_intr` at `sys/dev/disk/isp/isp.c:5121-5124`:
```c
while (tsto != oop) {
    optr = ISP_NXT_QENTRY(tsto, RESULT_QUEUE_LEN(isp));
}
```
The loop body assigns to `optr` but **never modifies `tsto` or `oop`** —
the condition is invariant. `isp_handle_other_response` (`:5113`) passes
`&tsto` to `isp_target_notify` (`isp_target.c:5988`), which in the long-IU
continuation path (`isp_target.c:178-181`) advances `*optrp` (= `tsto`).
After return, `tsto != oop` and the loop spins forever in hard interrupt
context → permanent kernel hang.

Requires `ISP_TARGET_MODE` compiled (not default) and a target-mode FC
adapter receiving an Extended CDB/IU > 56 bytes from a remote initiator.

## Reachability on this guest
**NOT reachable.** No QLogic ISP FC adapter present. `ISP_TARGET_MODE` is
not compiled into the default modules. Doubly gated. Latent.

A userspace harness demonstrates the invariant loop (capped at 1M iters to
prove non-termination rather than actually hang).

## Build / Run / Expected
```
cc -O2 -o harness harness.c     # build.sh
./harness                        # run.sh
# Expected: "LOOP DID NOT ADVANCE tsto -- infinite loop confirmed"
```

## Files
- `harness.c` — simulates the queue bookkeeping; proves the loop body never
  advances `tsto`.
- `fix.diff` — changes `while (tsto != oop)` to `if (tsto != oop)`.
- `build.log` / `run.log` / `env.txt` — captured outputs.