# VERDICT — DF-3596

**Status: inconclusive at runtime (no bwn hardware on the audit guest); defect source-certain.**
**Impact: DoS — unkillable lock-held kernel spin (wlan subsystem wedge) on stalled device.**

## Root cause (path:line)

Two `while (1)` loops poll device registers with **no iteration bound and no
timeout**, both executing with `BWN_LOCK` held (`sc_lk`, `lockmgr` exclusive —
`if_bwnvar.h:1030-1035`):

1. `bwn_intr_pmq()` — `sys/dev/netif/bwn/bwn/if_bwn.c:5168-5178`:
   ```c
   while (1) {
       tmp = BWN_READ_4(mac, BWN_PS_STATUS);
       if (!(tmp & 0x00000008))
           break;
   }
   ```
   Called from `bwn_intrtask` (`:4995-4996`) on every `BWN_INTR_PMQ` (part of
   `BWN_INTR_MASKTEMPLATE`, `if_bwnreg.h:326`), i.e. straight from the
   device's power-management-queue interrupt, under the lock taken at
   `:4954`.
2. `bwn_core_start()` — `if_bwn.c:2234-2239`:
   ```c
   while (1) {
       tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
       if (!(tmp & 0x00000001))
           break;
       tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
   }
   ```
   Reached from `bwn_init`/`bwn_hwreset`/`bwn_switch_band` with the lock held.

Every other polling loop in this driver is bounded (`bwn_dma_tx_reset`
10 iterations `:3307`, `bwn_mac_suspend` 35+40 `:3836-3847`, `bwn_psctl` 100
`:3898`, PIO rxeof 10 `:5567`, ucode-timeout loop 21 `:4263`) — these two are
the outliers, and the upstream Linux b43 equivalent (`b43_pio_tx` /
ssb-wait helpers) uses bounded waits.

Impact when a card stalls (failing hardware is the classic trigger; a
malicious mini-PCIe card can freeze the register deliberately): the loop never
exits; the bwn taskq thread spins at 100% holding `sc_lk` forever. Every later
`ifconfig bwn0 …`, TX wakeup (`bwn_start`), detach, or suspend blocks
unkillably on the lock; the watchdog callout (`sc_watchdog_ch` shares `sc_lk`,
`if_bwn.c:844`) also blocks, so even the device-timeout printer dies. Not a
panic — a permanent, unkillable subsystem wedge.

## Why runtime reproduction was not possible

Same as the sibling findings: the audit guest has no Broadcom 802.11 device
(`run.log`); the loop bodies are unreachable. A qemu-specific device model
would be required to emulate a stalling bwn card.

## Fix

Bound both loops with a retry budget and bail out with a device_printf on
timeout — see `fix.diff`.

## Artifacts

* `probe.sh`, `run.log` — guest probe (driver residency + hardware absence)
* `fix.diff` — proposed patch vs read-only `sys/` tree (never applied)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.