{
  "finding_id": "DF-4160",
  "status": "untested",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "likely",
  "verdict": "xe_mii_init() polls PHY_BMCR_RESET with an unbounded while loop (if_xe.c:1639, no timeout, no bailout) inside crit_enter() + ifnet serializer, reached at card insertion (xe_attach -> xe_init, if_xe.c:397) and on every interface up. A PHY that acks MII but never clears RESET (faulty or malicious PCMCIA card) hangs the kernel permanently. Hardware-gated: no Xircom PCMCIA hardware in the QEMU guest, so no runtime verification; source-level certainty (exit condition fully visible, no hidden bound). FreeBSD 10.3 carries the identical bug.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (source trace), fix.diff (bounded poll + graceful fallback)",
  "kernel_refs": ["sys/dev/netif/xe/if_xe.c:1637", "sys/dev/netif/xe/if_xe.c:1639", "sys/dev/netif/xe/if_xe.c:397", "sys/dev/netif/xe/if_xe.c:1625"],
  "poc_changes": "n/a (new finding, pass 2); no harness - the unbounded loop is directly visible in source",
  "attempts": 0,
  "guest_uname": "n/a (hardware-gated; no Xircom PCMCIA adapter exists in the QEMU guest)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix bounds the poll to 1000x1ms and returns phy_ok=0 on timeout, a state the driver already handles (10Mbit fallback); kernel-level validation impossible without the hardware",
  "fix_evidence": "fix.diff",
  "notes": "Pass-2 finding on sys/dev/netif/xe/if_xe.c; distinct from DF-1410/DF-4159. Low severity: requires physical insertion of faulty/hostile PCMCIA hardware.",
  "recommended_fix": "Bound the PHY reset poll in xe_mii_init() and treat a stuck-reset PHY as absent."
}