--- a/sys/dev/virtual/virtio/net/if_vtnet.c	2026-09-17 05:19:20.552939020 +0000
+++ b/sys/dev/virtual/virtio/net/if_vtnet.c	2026-09-17 05:19:35.688746841 +0000
@@ -2374,6 +2383,7 @@
 {
 	struct virtqueue *vq;
 	void *c;
+	int i;
 
 	vq = sc->vtnet_ctrl_vq;
 
@@ -2404,8 +2414,20 @@
 	 * virtqueues. We do not support sharing both a Vq and config
 	 * changed notification on the same MSIX vector.
 	 */
-	c = virtqueue_poll(vq, NULL);
-	KASSERT(c == cookie, ("unexpected control command response"));
+	/*
+	 * Poll until the command is complete, but never forever: a wedged
+	 * or malicious device must not permanently spin this kernel thread
+	 * while it holds the ifnet serializers. Give the device ~1 second
+	 * (10000 x 100us); on timeout leave the caller's ack at
+	 * VIRTIO_NET_ERR so every caller reports EIO.
+	 */
+	for (i = 0; i < 10000; i++) {
+		c = virtqueue_dequeue(vq, NULL);
+		if (c == cookie)
+			return;
+		DELAY(100);
+	}
+	device_printf(sc->vtnet_dev, "control virtqueue command timeout\n");
 }
 
 static int