{
  "finding_id": "DF-4306",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Source-certain unbounded-wait defect (DF-4217 family shape): e1000_release_swfw_sync_80003es2lan (sys/dev/netif/ig_hal/e1000_80003es2lan.c:449-463) acquires the SWSM hardware semaphore in an empty-body unbounded loop (:455-456). e1000_get_hw_semaphore_generic (e1000_mac.c:1721) is bounded per call (word_size+1 iterations of usec_delay(50), word_size capped at 16384 by :176-178) and returns -E1000_ERR_NVM on timeout, so a stuck SMBI bit (ASF/management-firmware hold - this MAC sets asf_firmware_present=TRUE at :223 - wedged sibling function on the dual-port part, or post-bus-error device) makes the outer loop retry the full ~1.6s MMIO poll forever. Every PHY register access (:482/:499/:514/:531, :553/:570/:585/:602), KMRN access (:1388/:1402/:1425/:1436), NVM wrapper path (:368-391) and reset_hw (:845-851) funnel through this release while the caller holds the igb driver serializer: a stuck semaphore pins one CPU at 100% MMIO spin and wedges every interface entry point until reboot. The acquire side is bounded (50x5ms, :412-431) - the release side simply lost the bound. Identical upstream-inherited shape at e1000_82575.c:1110 and e1000_i210.c:146. Kernel-path reproduction impossible on this guest: no 80003ES2LAN/igb device exists (env.txt: hw.igb unknown oid, virtio-only) - not_reproduced per family convention (DF-3827). Impact ceiling: CPU livelock + interface wedge on real hardware; trigger is a hardware/firmware fault state, not attacker-controllable - Low severity, availability only.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (path:line trace incl. per-call bound analysis of e1000_get_hw_semaphore_generic and the whole-file checklist negative results); env.txt (hw.igb unknown oid, virtio-only guest, guest src md5 == audited tree); fix.diff (bounded retry, patch -p1 --dry-run clean)",
  "kernel_refs": [
    "sys/dev/netif/ig_hal/e1000_80003es2lan.c:455",
    "sys/dev/netif/ig_hal/e1000_80003es2lan.c:449",
    "sys/dev/netif/ig_hal/e1000_80003es2lan.c:223",
    "sys/dev/netif/ig_hal/e1000_80003es2lan.c:412",
    "sys/dev/netif/ig_hal/e1000_mac.c:1721",
    "sys/dev/netif/ig_hal/e1000_82575.c:1110",
    "sys/dev/netif/ig_hal/e1000_i210.c:146"
  ],
  "poc_changes": "No seed; no runnable PoC exists without an 80003ES2LAN device - pack documents the source proof, per-call cost analysis, family cross-references, and the fix.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "(none - hardware-gated path)",
  "run_cmd": "vm.sh run_root sysctl hw.igb 2>&1 | head -1; ifconfig -l",
  "code_hash": "",
  "notes": "Fourth ig_hal checklist pass result: items (a)-(d),(f),(g) all clean with proof (VERDICT.md); the sole surviving defect is (e)s release-side unbounded spin. Same shape should be fixed at e1000_82575.c:1110 and e1000_i210.c:146 when this is addressed.",
  "recommended_fix": "Bound the release retry to the acquire-side budget (e.g. 50 attempts) and give up with a debug print instead of spinning forever; replicate at e1000_82575.c:1110 and e1000_i210.c:146; see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (patch -p1 --dry-run clean); cannot be runtime-validated without 80003ES2LAN hardware.",
  "fix_evidence": "findings/poc/DF-4306/fix.diff"
}