# DF-3596 — Unbounded device-register polling loops under BWN_LOCK (bwn_intr_pmq, bwn_core_start): permanent lock-held wedge on stalled device

## Build / Run / Expected

```
# on the DF guest, as root:
sh probe.sh
```

Guest result: driver resident, **no Broadcom hardware** → runtime `inconclusive`.
On a BCM43xx machine with a wedged/failing card (or malicious card that simply
stops updating the PS_STATUS / XMITSTAT registers): the next PMQ interrupt or
core-start spins forever reading the frozen register while holding `sc_lk`
exclusive — the bwn taskq thread pegs a CPU, every subsequent ioctl/start/stop
on the interface blocks forever in `lockmgr` (unkillable), and the device can
no longer be reset or detached. System-wide soft hang of the wlan subsystem.