{
  "finding_id": "DF-2470",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "denial_of_service",
  "confidence": "certain",
  "verdict": "The verbatim response-loop fragment (isp.c:5113-5124, extracted by exact line range) never terminates once entered: the loop body only assigns optr and never modifies tsto or oop, and tsto != oop is the entry condition the code itself describes (the isp.c:5107 comment - somebody reachable via isp_handle_other_response may have updated the queue pointer). The compiled-with-ISP_TARGET_MODE verbatim isp_handle_other_response (whose rig interposition of isp_target_notify advances the output pointer exactly per the target-mode contract) drives tsto != oop; a dispatch thread entered the loop and a 3s watchdog proved it still inside - a permanent hang of the interrupt context. Config gate verified: no in-tree build defines ISP_TARGET_MODE (grep over sys/), so every stock kernel and the stock isp.ko are unaffected; the defect is real for anyone enabling target mode. Fix (single-step optr advance) A/B: the dispatch thread exits the fragment immediately (loop EXITED printed; the watchdog message in the fixed run is a known heuristic false positive because the adapted return path skips the done-flag).",
  "exploit_chain": "no privesc - interrupt-context hang (system freeze) on a config-gated path.",
  "evidence": "run.log: watchdog - dispatch thread STILL INSIDE isp_intr response loop after 3s, done=0; fixed run: DF2470 loop EXITED immediately.",
  "kernel_refs": [
    "sys/dev/disk/isp/isp.c:5113",
    "sys/dev/disk/isp/isp.c:5121",
    "sys/dev/disk/isp/isp.c:5122"
  ],
  "poc_changes": "loop fragment extracted by line range with documented mechanical adaptations (goto target and continue live in the wrapper; loop text untouched).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "build_cmd": "sh /root/rigs/dfv_ispt/gen.sh && make -m /usr/src/share/mk (in dfv_ispt)",
  "run_cmd": "kldload dfv_ispt.ko; sysctl kern.dfv_ispt_run=2; sleep 4; sysctl -n kern.dfv_ispt_status",
  "code_hash": "17f30f813d452e4f0168d478cf5258df01d7326d7f29e5ea16f5567f9c6e3b04",
  "notes": "Config-gated: no in-tree build defines ISP_TARGET_MODE (verified: no #define ISP_TARGET_MODE anywhere in sys/); defect real in the target-mode code path. Non-termination proven by watchdog on the verbatim loop fragment; watchdog text in the fixed run is a heuristic false positive - the loop EXITED immediately after the fix.",
  "recommended_fix": "replace the non-terminating while loop with a single optr advance",
  "fix_status": "fixed"
}