# DF-2470 verdict -- Infinite loop in isp response-queue pointer update (target mode)

status: reproduced   reproduced: 1   impact: denial_of_service
confidence: certain   attempts: 1   runtime_sec: 300

The verbatim response-loop fragment (isp.c:5113-5124, extracted by exact line range) never terminates once entered: the loop body only assigns optr and never modifies tsto or oop, and tsto != oop is the entry condition the code itself describes (the isp.c:5107 comment - somebody reachable via isp_handle_other_response may have updated the queue pointer). The compiled-with-ISP_TARGET_MODE verbatim isp_handle_other_response (whose rig interposition of isp_target_notify advances the output pointer exactly per the target-mode contract) drives tsto != oop; a dispatch thread entered the loop and a 3s watchdog proved it still inside - a permanent hang of the interrupt context. Config gate verified: no in-tree build defines ISP_TARGET_MODE (grep over sys/), so every stock kernel and the stock isp.ko are unaffected; the defect is real for anyone enabling target mode. Fix (single-step optr advance) A/B: the dispatch thread exits the fragment immediately (loop EXITED printed; the watchdog message in the fixed run is a known heuristic false positive because the adapted return path skips the done-flag).

## Evidence (decisive lines)
dfv_ispt: DF2470 watchdog: dispatch thread STILL INSIDE isp_intr response loop after 3s -- NON-TERMINATING (interrupt-context hang)
; DF2470 done=0 reported=1
--- fixed source A/B ---
dfv_ispt: DF2470 loop EXITED done=0     <- thread completed instantly




## Exploit chain / privesc assessment
no privesc - interrupt-context hang (system freeze) on a config-gated path.

## Fix + A/B
fix.diff converts the while loop to a single guarded advance; fixed rig run exits immediately.


## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.