{
 "finding_id": "DF-2335",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "dos",
 "confidence": "certain",
 "verdict": "ehci_pci_take_controller (ehci_pci.c:504-548) verbatim rig with a scripted PCI config space: a self-referential extended-capability entry (EECP 0x50, NEXT=0x50, non-LEGSUP) makes the verbatim loop spin forever - the sysctl call never returns, ssh dies, the serial console stops being served and the QEMU process had to be SIGKILLed from the host; the linear control returns in microseconds (3 config reads). The LEGSUP variant additionally burns the 500x10ms BIOS wait per iteration (127,245 pause units observed) as the finding describes. With the iteration cap and the sub-0x40 guard the self-cycle returns after exactly 255 reads and the low-offset chain is refused. Requires a malicious/fuzzed PCI EHCI controller (physical or passed-through).",
 "exploit_chain": "",
 "evidence": "hang.txt (baseline wedge), run_fixed_kernel.log (selfcycle RETURNED pci_reads=255; legsupspin RETURNED with bounded pause_calls), rig/dfbatch_ehci.c + gen.sh (verbatim gate), fix.diff",
 "kernel_refs": [
  "sys/bus/u4b/controller/ehci_pci.c:517",
  "sys/bus/u4b/controller/ehci_pci.c:519",
  "sys/bus/u4b/controller/ehci_pci.c:544"
 ],
 "poc_changes": "rig scenario initially zeroed the whole capability dword when scripting the BIOS semaphore byte (fixed to byte-granular writes); usb_pause_mtx interposed with a counter so the 20s-per-iteration claim is measured, not slept",
 "attempts": 6,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #5 DFBATCH Wed Oct 21 21:27:34 UTC 2026 root:/usr/obj/usr/src/sys/DFBATCH x86_64 (rig kernel); stock baseline #0 X86_64_GENERIC",
 "runtime_sec": 2400,
 "guest_dirty": 0,
 "build_cmd": "sh gen.sh + make nativekernel KERNCONF=DFBATCH (kernel rig)",
 "run_cmd": "sysctl debug.dfbatch.cmd=\"ehci <linear|selfcycle|abcycle|legsupspin|lowoff>\"",
 "code_hash": "bf7b366ba6f65b6636eff79e690a5c163be44e806bdeaf6ba35c5974723fa5a4",
 "notes": "fix validated A/B on the same rig: baseline behavior gone post-patch (see run_fixed* logs); rig kernel = X86_64_GENERIC + device dfbatch, INVARIANTS kept",
 "recommended_fix": "cap EECP iterations at 255 and refuse offsets below the 0x40 config header"
}