# DF-4258 VERDICT — unbounded `while (BMCR & RESET)` spin in my_autoneg_xmit

## Status: inconclusive on the audit guest (hardware-gated). Missing bound certain at source level.

## Reproduction attempt

No Myson PCI device on the guest (env.txt) — `my0` cannot exist, the MII
bit-bang (`my_send_cmd_to_phy`, if_my.c:161-209) cannot run. This matches
the treatment of the sibling unbounded-loop family findings (DF-4217 ae
`i--` and the DF-3604/3761/3715 NIC-checklist set, all hardware-gated).

## Analysis

if_my.c:379 is the only hardware-wait loop in the driver without the
MY_TIMEOUT guard — contrast if_my.c:708-714 (my_setcfg) and if_my.c:738-743
(my_reset), both `for (i = 0; i < MY_TIMEOUT; i++)` with a failure
kprintf. The reset poll executes:

* at boot for every attach (FORCEDELAY, if_my.c:946 → 422),
* from `my_ifmedia_upd` on SIOCSIFMEDIA (root via ifconfig, if_my.c:1508-1511),
* from `my_txeoc` **in the interrupt service routine** when a deferred
  autoneg fires (if_my.c:1203-1204 → 436).

A PHY whose BMCR read sticks at 0xFFFF (hung part, unplugged card, PCI
error) or that never completes self-reset parks the caller forever. In the
ISR case `ifp->if_serializer` is held by `my_intr` (established via
`bus_setup_intr(..., ifp->if_serializer)`, if_my.c:955-957), so the whole
ifnet — watchdog included — is wedged: system-level denial of service on
affected hardware. Root ioctl or hardware fault required to trigger at
runtime; boot variant needs no privileges but requires a broken PHY on the
installed card.

Severity Low (hardware/root-gated DoS), CWE-835, confidence certain for
the missing bound.

## Fix

Bound the loop like my_reset does (fix.diff): poll MY_TIMEOUT iterations
with DELAY(10) and warn if the reset never completes.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.