# DF-4217 — ae(4) idle-wait loops count DOWN (`i--`): non-idle device wedges the kernel thread forever

`sys/dev/netif/ae/if_ae.c` — pass 2 (GLM 5.3).

## Build

```
scp -F dfbsd-qemu/config findings/poc/DF-4217/stoploop.c dfbsd:/tmp/
vm.sh run_root 'cc -O2 -Wall -Wextra -o /tmp/df4217 /tmp/stoploop.c && /tmp/df4217'
```

Clean build (`-Wall -Wextra`, no warnings), RC=0.

## Run

```
vm.sh run_root '/tmp/df4217; echo RC_4217=$?'
```

## Expected output

The model runs the exact guard/increment/exit shape of the two loops
(`for (i = 0; i < AE_IDLE_TIMEOUT; i--)`, AE_IDLE_TIMEOUT=100) against a
register stub that never reports idle (a surprise-removed / halted device
whose MMIO reads return 0xFFFFFFFF):

1. As written (`i--`): the guard `i < 100` is permanently true (i only
   decrements from 0).  The model self-caps at 10,000,000 iterations —
   the kernel loop has **no** cap — and shows the post-loop
   `if (i == AE_IDLE_TIMEOUT)` timeout branch is unreachable
   (i = -9999999 ≠ 100, and it can never rise to 100 again).
2. Fixed (`i++`): the same dead device terminates after exactly 100
   reads (10 ms) and the "timed out while stopping Rx/Tx MAC." message
   fires.

Success criterion: `[1]` shows 10,000,000 capped iterations with the
timeout branch NOT taken; `[2]` shows 100 reads.  `RC_4217=0`.

## Why only a model (no end-to-end run)

The loop's exit depends on the physical device reporting idle.  The audit
guest has no Attansic L2 NIC (no 1969:xxxx PCI device; `if_ae` not in
X86_64_GENERIC) — hardware-gated per the DF-3934/DF-3990/DF-3991 family
convention.  The termination defect itself is a pure control-flow
property, demonstrated by the model and by inspection.

Guest was left clean (this run never wedges anything).