{
  "finding_id": "DF-4258",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "my_autoneg_xmit polls the PHY reset bit with while (my_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_RESET); (sys/dev/netif/my/if_my.c:379) \u2014 the only hardware-wait loop in the driver without a MY_TIMEOUT bound (contrast my_setcfg 708-714 and my_reset 738-743). A PHY whose BMCR reads stick at 0xFFFF (hung part, card unplugged, PCI error \u2014 bit 15 always set) parks the caller forever, each iteration being a ~ms-scale bit-banged MII transaction. Reachable from SIOCSIFMEDIA (ifconfig media autoselect, if_my.c:1508-1511), at boot from my_attachs FORCEDELAY autoneg (if_my.c:946), and \u2014 worst \u2014 from my_txeoc inside the ISR with ifp->if_serializer held (if_my.c:1203-1204, bus_setup_intr established against the serializer at 955-957), which wedges the whole ifnet including its watchdog. Not executable on the audit guest (no Myson NIC, env.txt); missing bound is certain at source level. This is the my(4) instance of the unbounded idle/reset-loop family (cf. DF-4217).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (all three trigger contexts + bounded-loop contrast); env.txt",
  "kernel_refs": [
    "sys/dev/netif/my/if_my.c:377-379",
    "sys/dev/netif/my/if_my.c:708-714",
    "sys/dev/netif/my/if_my.c:738-743",
    "sys/dev/netif/my/if_my.c:955-957",
    "sys/dev/netif/my/if_my.c:1203-1204",
    "sys/dev/netif/my/if_my.c:1508-1511"
  ],
  "poc_changes": "trigger.sh wraps the ifconfig in timeout(1) to make the wedge observable",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "./trigger.sh (requires my0 + hung PHY)",
  "notes": "Trigger requires root ioctl or broken hardware; severity stays Low.",
  "recommended_fix": "Bound the BMCR reset poll with the same MY_TIMEOUT loop used in my_reset",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the bounded poll + warning, mirroring my_reset; hardware-gated, not validated here",
  "fix_evidence": "findings/poc/DF-4258/fix.diff"
}