{
  "finding_id": "DF-2324",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Reproduced mechanically on the stock INVARIANTS kernel: the verbatim pci_read_capabilities loop (pci.c:877-892) never returned on a fabricated 0x40<->0x60 capability cycle (device-controlled next pointers; pci_fixup_nextptr masks alignment but does not detect revisits), and the verbatim pci_find_extcap_method loop (pci.c:1407-1414) never returned on the same cycle - both captured decisively by a 2 Hz hard-IRQ systimer watchdog that panics with a marker after 12 s (the sysctl caller was still stuck inside the walker). pci_find_extcap_method additionally follows UNALIGNED next pointers (0x40->0x45->0x4A observed), confirming the missing sanitization vs pci_fixup_nextptr. Impact is an unbounded-enumeration-loop hang: a malicious PCI device hangs boot/hotplug enumeration (availability only, no corruption); impact recorded as panic because the watchdog panic is the captured proof of the non-returning loop. Fix A/B validated: with the iteration caps (48 for read_capabilities, 64 for extcap) plus ptr masking in extcap, both cycles terminate (RETURNED / ENXIO) and the legit 4-cap linear chain digests byte-identically to the unfixed kernel.",
  "exploit_chain": "malicious PCI device puts a cyclic next-pointer chain (0x40 next=0x60; 0x60 next=0x40) in config space -> pci_read_capabilities at boot enumeration spins forever -> boot hang; same cycle via pci_read_config in pci_find_extcap_method hangs driver probe/attach paths",
  "evidence": "panic_cap_cycle.txt (watchdog marker panic, systimer hard-IRQ frames, sysctl never returned), panic_extcap_cycle.txt (same for extcap), rig/linear_baseline.log (legit chain digest), rig/fixed_runs.log (cap cycle RETURNED, extcap cycle RETURNED rc=6, CAPDIGEST identical to baseline)",
  "kernel_refs": [
    "sys/bus/pci/pci.c:877",
    "sys/bus/pci/pci.c:882",
    "sys/bus/pci/pci.c:601",
    "sys/bus/pci/pci.c:1407",
    "sys/bus/pci/pci.c:1413"
  ],
  "poc_changes": "used the shared DFPCI verbatim-interposition harness (see DF-2323 pack): fabricated 256-byte config space served to the verbatim walkers through the PCIB_READ_CONFIG/pci_read_config interposition; watchdog is a periodic systimer whose callback panics from hard-interrupt context after 12 s if the armed command did not return",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Sun Oct 18 18:36:44 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/DFPCI x86_64 (hangs); fixed runs on #0 Sun Oct 18 19:54:35 UTC 2026 DFPCIPF",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "sh rig/build.sh DFPCI (same harness as DF-2323; see that pack)",
  "run_cmd": "vm.sh run_root \"sysctl debug.dfpcih.cmd=cap_cycle\" (scenarios: cap cycle, cap linear, extcap cycle, extcap linear, extcap odd) then vm.sh log 70; rig/run_2324.sh",
  "code_hash": "ce238fc92dcbe657b33d6084dfbc60caa3ace94d56814d639d95ec5c0582105e",
  "notes": "hang is the true impact (DoS of boot/hotplug enumeration); impact enum lacks a dos value so panic is recorded as the captured proof class; watchdog pattern per the idr session; no DB writes by reviewer",
  "recommended_fix": "add iteration caps to both walkers (48 aligned slots for read_capabilities, 64 for extcap) and apply pci_fixup_nextptr-style low-bit masking to pci_find_extcap_method"
}