# DF-2026 PoC — Multi-part SSIF response read loop has no iteration cap

**Status:** `inconclusive` / reproduced=0 — **HW-GATED** (IPMI SSIF needs a BMC; none
present, `ipmi.ko` not loaded).

**Verification method:** source trace of `sys/dev/misc/ipmi/ipmi_ssif.c:257` (`for (;;)`),
lines 260-262, 274, 297-299. The multi-part READ_CONT loop has no iteration cap; a BMC that
returns `0xff` (or incrementing matching block numbers) on every READ_CONT spins it forever
⇒ kernel infinite-loop DoS (CWE-835). See `VERDICT.md`, `fix.diff`.

**Build/run:** no runtime PoC (no BMC). `fix_build.log` proves the fix compiles under
`-Werror` rc=0.