{
  "finding_id": "DF-3596",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Source-certain unbounded polling: bwn_intr_pmq (if_bwn.c:5172-5176) and bwn_core_start (if_bwn.c:2234-2239) spin on device registers with no retry bound while holding sc_lk (lockmgr exclusive); a stalled/failing card (or malicious mini-PCIe device) freezes the thread with the lock held, wedging every later bwn ioctl/start/stop/detach and the watchdog callout permanently and unkillably. All other polling loops in the driver are bounded (e.g. :3307, :3836, :3898, :5567) \u2014 these two are the outliers. Guest has no Broadcom device (run.log), so the loop bodies are unreachable at runtime.",
  "exploit_chain": "",
  "evidence": "VERDICT.md loop-by-loop analysis with bounded-loop contrast; run.log guest probe; fix.diff adds retry budgets + timeout messages",
  "kernel_refs": [
    "sys/dev/netif/bwn/bwn/if_bwn.c:5172",
    "sys/dev/netif/bwn/bwn/if_bwn.c:2234"
  ],
  "poc_changes": "No runnable PoC possible without hardware; probe.sh substitutes",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (X86_64_GENERIC, INVARIANTS)",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "n/a (source-level; probe.sh only)",
  "run_cmd": "vm.sh run_root sh probe.sh",
  "code_hash": "1dd0c720eadc950b8900406eb0ca725b8ba6f8b9f6969a1e3214900e2a1dc703",
  "notes": "CWE-835. Not a panic: soft unkillable hang. DELAY(10) added in fix keeps the loop bounded (~10ms worst case) matching the drivers other bounded waits.",
  "recommended_fix": "Bound both register-drain loops with retry budgets and timeout diagnostics",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/; cannot baseline-validate without BCM43xx hardware",
  "fix_evidence": "fix.diff in this pack"
}