# DF-4306 — e1000_release_swfw_sync_80003es2lan spins unboundedly acquiring the HW semaphore on every PHY/NVM release path

**File:** `sys/dev/netif/ig_hal/e1000_80003es2lan.c` (pass 2, no known findings)
**Lines:** 449-463 (`e1000_release_swfw_sync_80003es2lan`, empty-body `while` at :455-456), reached from every PHY/KMRN/NVM release on this MAC: :499/:514/:531 (gg82563 read), :570/:585/:602 (gg82563 write), :318 (phy release wrapper), :353 (KMRN mac_csr release), :375/:391 (NVM release), :851 (reset_hw).
**Family shape:** `while (e1000_get_hw_semaphore_generic(hw) != E1000_SUCCESS);` — identical pattern at `e1000_82575.c:1110` and `e1000_i210.c:146` (upstream-inherited Intel HAL; Linux e1000e has the same construct).

## The bug

The SW/FW-sync *acquire* side is bounded (50 × 5 ms, :402-439), but the
*release* side takes the SWSM hardware semaphore in an **unbounded**
retry loop:

```c
while (e1000_get_hw_semaphore_generic(hw) != E1000_SUCCESS)
	; /* Empty */                       /* e1000_80003es2lan.c:455-456 */
```

`e1000_get_hw_semaphore_generic` (e1000_mac.c:1721) is itself a bounded
busy-wait (timeout = `nvm.word_size + 1` iterations of `usec_delay(50)`;
word_size ≤ 16384 by the :176-178 cap ⇒ up to ~1.6 s of MMIO spin per
attempt) that returns `-E1000_ERR_NVM` when the SMBI bit stays set. A
stuck SMBI bit — management-firmware hold (this MAC reports
`asf_firmware_present = TRUE`, :223), a second port's driver wedged, or a
device gone south after a bus error — therefore turns **every** release
call into an infinite ~1.6 s-step MMIO spin. All call sites run under the
igb driver serializer; the spinning thread pins its CPU, burns the PCI
link with MMIO reads, and blocks every other entry point on the interface
until reboot.

Severity Low per rubric: "narrow trigger … requires specific hardware"
(the 80003ES2LAN NIC plus a wedged SMBI bit — a hardware/firmware fault,
not attacker-controllable state). The code shape itself is certain.

## Guest status

No 80003ES2LAN (or any igb) device on this guest (env.txt: `hw.igb`
unknown oid, virtio-only); not_reproduced per family convention
(cf. DF-3827). Defect certain from source.

## Fix

Bound the retry (mirroring the acquire-side 50×5 ms budget) and bail with
a debug print instead of spinning forever — see fix.diff
(`patch -p1 --dry-run` clean). Trade-off documented in the diff: bailing
leaves the SW_FW_SYNC bit set (PHY/NVM access bricked) but saves the CPU
and the system; the NIC is unusable either way with a stuck semaphore.