# DF-4160 — Unbounded PHY-reset poll in xe_mii_init()

**File:** `sys/dev/netif/xe/if_xe.c:1637-1639` · Low · CWE-835 · hardware-gated

`while(xe_phy_readreg(scp, PHY_BMCR) & PHY_BMCR_RESET);` has no timeout and
runs in `crit_enter()` + ifnet serializer at PCMCIA card insertion
(`xe_attach` → `xe_init`, `if_xe.c:397`) and on every interface up. A PHY that
acks MII but never clears RESET (faulty or malicious card — PCMCIA is
attacker-insertable hardware) hangs the kernel permanently.

- Full analysis: `VERDICT.md`
- Fix: `fix.diff` (bounded poll, stuck PHY treated as absent → existing
  10Mbit fallback path)
- No runtime verification possible: the QEMU audit guest has no PCMCIA/Xircom
  hardware. Status `untested`, per-audit convention for hardware-gated DoS
  findings.