# DF-4549 — viapm_wait() off-by-one: SMB_ETIMEOUT can never be reported on a real timeout (and is spuriously set on a last-poll success)

File: `sys/dev/powermng/viapm/viapm.c` lines 566-605 (loop at 574-581, test at 587-588).

## Build / Run (guest logic demo)

```
dfbsd-qemu/vm.sh reset with-src            # clean guest
# push viapm_wait_offbyone_demo.c (base64 over run_user) then:
cc -Wall -Wextra -o /tmp/df4549 /tmp/df4549.c && /tmp/df4549
```

## Expected output (see run.log)

```
case A (perpetual BUSY, real timeout): error=0x0 -> *** SMB_ETIMEOUT MISSING: kernel reports SUCCESS on wedged bus ***
case B (INTR on final poll, success):   error=0x20 -> *** SPURIOUS SMB_ETIMEOUT on successful transaction ***
```

The demo replicates the exact `while (count--) { ... break; }` / `if (!count)` pair
from viapm.c:574-588 with a fixture register read.

## Why the kernel path itself is not run on the guest

`viapm`/`viapropm` are PCI drivers for VIA VT82C586B/596x/686A/823x PMU+SMBus
controllers. The QEMU guest has no such PCI device (`pciconf -l` — see
`guest_hw_evidence.txt`), so the module loads but never attaches and
`viasmb_*()` is unreachable. The defect is pure C arithmetic, proven by the
compiled demo; the hardware path is gated on a real VIA southbridge.

Both logs (`run.log`, `guest_hw_evidence.txt`) are the artifacts.