# DF-4415 — VERDICT

**status: not_reproduced for the unbounded loop itself (needs controller/EC data flood — hardware injection); the unprivileged reachability of the affected code paths WAS reproduced live**

## What was reproduced on the guest (DF 6.5-DEVELOPMENT, atkbdc0+psm0, QEMU i8042)

* `/dev/psm0` is world read/write (`crw-rw-rw-`), `/dev/kbd0` `/dev/kbd1`
  are root-only.
* As uid 1999: `open("/dev/psm0")` OK; `MOUSE_GETHWINFO` returns a real
  PS/2 mouse (buttons=5, iftype=3, hwid=4 — `psm0: model IntelliMouse
  Explorer, device ID 4 on atkbdc0`); 20× `MOUSE_SETMODE` all succeed,
  worst latency 0.0074 s.
* Every `MOUSE_SETMODE` reprograms the aux device through
  `send_aux_command()` (atkbdc.c:647-670) → `write_aux_command()` (:616)
  → `write_controller_command()` (:586) → `wait_while_controller_busy()`
  (:417-439) and `wait_for_aux_ack()` (:545-569) — the DELAY()-busy poll
  chain. On a healthy controller this is single-digit milliseconds; the
  code burns up to ~70-200 ms × KBD_MAXRETRY(3) per command when the
  controller stalls (TOTALDELAY-bounded — a CPU-burn amplifier for any
  unprivileged user spamming psm ioctls, but bounded).

## The actual defect (not demonstrable from guest userspace)

Four drain loops reset their budget on **every received byte** and have no
overall cap, so a controller that keeps streaming data wedges the kernel
thread indefinitely:

* `empty_kbd_buffer()` atkbdc.c:865-882 — `t = wait;` on each byte
* `empty_aux_buffer()` atkbdc.c:905-922 — same
* `read_kbd_data_no_wait()` atkbdc.c:799-804 — `while (f == KBDS_AUX_BUFFER_FULL)` keeps reading
* `read_aux_data_no_wait()` atkbdc.c:838-843 — mirror image

The maintainer-acknowledged precedent is in the same file:
`empty_both_buffers()` atkbdc.c:959-966 has a `waited` cap with the
comment "Some systems (Intel/IBM blades) do not have keyboard devices and
will hang in this procedure. Time out … to avoid this hang". The four
siblings never received the cap.

## Threat model

Malicious/slow EC or i8042 device model (embedded coreboot ECs, VM hosts
— the file's own quirk table documents "imperfect i8042 emulation"
coreboot ECs at atkbdc.c:112-128), or a controller wedge during
unprivileged ioctl storms through /dev/psm0. Impact: permanent kernel
busy-loop (thread wedge / CPU starvation) → Low (hardware precondition).

## Fix

Port the `waited` cap to the two `empty_*_buffer()` functions and bound
the two `read_*_no_wait()` drain loops. See `fix.diff`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.