BUILD_EXIT=0
DF-2003 source-confirmation (SMIC unbounded busy-wait)
======================================================
[1] smic_wait_for_tx_okay (ipmi_smic.c:53-61):
      do { flags = INB(sc, SMIC_FLAGS); }
      while (!(flags & SMIC_STATUS_TX_RDY));
    => NO timeout, NO DELAY, NO signal check. UNBOUNDED.
[2] smic_wait_for_rx_okay (ipmi_smic.c:63-71):
      do { flags = INB(sc, SMIC_FLAGS); }
      while (!(flags & SMIC_STATUS_RX_RDY));
    => NO timeout, NO DELAY, NO signal check. UNBOUNDED.
[3] smic_wait_for_not_busy (ipmi_smic.c:73-81):
      do { flags = INB(sc, SMIC_FLAGS); }
      while (flags & SMIC_STATUS_BUSY);
    => NO timeout, NO DELAY, NO signal check. UNBOUNDED.

[4] Contrast -- sibling KCS transport (ipmi_kcs.c:60,66,83,89):
      while (ticks - start < MAX_TIMEOUT && <cond>) {
          DELAY(100);
      }
    KCS is correctly bounded. SMIC is the only unbounded IPMI backend.

[5] MAX_TIMEOUT is defined (ipmivars.h:219: '#define MAX_TIMEOUT 6*hz')
    but NEVER referenced in ipmi_smic.c (407 lines, zero MAX_TIMEOUT
    and zero DELAY uses). The bound exists but is not applied to SMIC.

[6] smic_loop kthread (ipmi_smic.c:355-376) calls smic_polled_request
    which calls the wait functions. ipmi_detach (ipmi.c:895) does
    lksleep(...,timeout=0) on the kthread -- infinite -- so a stuck
    kthread blocks detach forever and wedges shutdown.

Verdict: a slow/hung/faulty/compromised BMC makes smic_loop spin at
100% CPU forever, unkillable, blocking module unload and shutdown.
HW-gated: requires SMIC IPMI interface + BMC (not on guest).

ALL_PROPERTIES=CONFIRMED
RUN_EXIT=0