# DF-2324 — PCI capability-list traversal lacks cycle detection — evidence pack

Finding: `sys/bus/pci/pci.c:877-892` (`pci_read_capabilities`) and
`pci.c:1407-1414` (`pci_find_extcap_method`) loop on device-controlled
capability next-pointers with no iteration bound (and extcap follows
unaligned pointers without the pci_fixup_nextptr masking) — a malicious
device with a cyclic cap list hangs kernel enumeration.

## Verdict (short)

REPRODUCED on the stock INVARIANTS kernel: both walkers driven with a
fabricated 0x40<->0x60 cycle NEVER returned; a 2 Hz hard-IRQ systimer
watchdog fired at 12 s with marker panics (panic_cap_cycle.txt,
panic_extcap_cycle.txt) — decisive hang proof. The unaligned-pointer
follow (0x40->0x45->0x4A) also demonstrated (extcap, no masking).
Legit linear chains enumerate identically pre/post fix (CAPDIGEST
byte-identical). Fixed kernel: both cycles terminate (RETURNED /
ENXIO).

## Rig

Shared with DF-2323 (same kernel-compiled verbatim-interposition
harness, same verbatim sha256 gates — see DF-2323/rig and env.txt).
Trigger: `sysctl debug.dfpcih.cmd="cap cycle|cap linear|extcap
cycle|extcap linear|extcap odd"`.

## Reproduce

See rig/run_2324.sh; fixed-kernel A/B in rig/fixed_runs.log
(DFPCIPF = production config + rig/fix.diff).

## Files

* VERDICT.md — narrative, tables, fix A/B
* panic_cap_cycle.txt, panic_extcap_cycle.txt — watchdog hang captures
* rig/linear_baseline.log — legit-chain digest (stock kernel)
* rig/fixed_runs.log — fixed-kernel runs (cycles RETURN, digest identical)
* rig/ — harness + generators + fix.diff (shared rig, identical copies)
* env.txt, manifest.json, verdict.json