$ scp -F dfbsd-qemu/config findings/poc/DF-4217/stoploop.c dfbsd:/tmp/
stoploop.c                              100% |********************************|  (guest scp ok)

$ vm.sh run_root 'cc -O2 -Wall -Wextra -o /tmp/df4217 /tmp/stoploop.c && echo BUILD_4217_OK'
BUILD_4217_OK

$ vm.sh run_root '/tmp/df4217; echo RC_4217=$?'
DF-4217 model: ae_stop_rxmac/ae_stop_txmac idle-wait termination
(sys/dev/netif/ae/if_ae.c:288 and :324, AE_IDLE_TIMEOUT=100)

[1] as-written (i--) vs a device that never reports idle:
    MODEL SELF-CAP HIT (10,000,000 iterations) -- the kernel loop has NO cap;
    guard (i < 100) is permanently true because i only decrements from 0.
    iterations executed (model-capped): 10000000
    post-loop timeout branch `i == AE_IDLE_TIMEOUT` taken: NO -- unreachable by construction (i=-9999999)
[2] fixed (i++): same dead device -> loop exits after exactly 100 reads
    (10 ms), then the "timed out while stopping Rx/Tx MAC." message fires. Bounded either way.

TRIGGER_RC=0 (model OK; hardware-gated on this guest: no Attansic L2 NIC)
RC_4217=0

(full untrimmed guest output of the decisive run)