# DF-4699 — nvme(4): admin commands have no timeout — a stalled controller permanently wedges the admin thread and all teardown

## Where
`sys/dev/disk/nvme/nvme.c:539-562` `nvme_wait_request()`; every admin-thread state function
in `sys/dev/disk/nvme/nvme_admin.c` (`nvme_admin_state_identify_ctlr`:229-234,
`nvme_admin_state_make_queues`:319-327/527-541, `nvme_admin_state_identify_ns`:594-630).

## Trace
* `nvme_wait_request()` (nvme.c:549-554) loops `while (state == SUBMITTED)
  { poll; lksleep(req, lk, 0, "nvwait", hz); }` — **no deadline, no retry limit, no
  abort/reset escape**. The 1 hz sleep timeout only re-loops.
* All admin state functions call it while holding `sc->admin_lk` (taken once in
  `nvme_admin_thread`, nvme_admin.c:158).
* A controller that accepts a submission and never posts the completion (broken/frozen
  firmware, malicious device — trivially done by a crafted emulator) wedges the admin
  thread forever.
* Consequences: `ADMIN_SIG_PROBED` is never set, so `nvme_stop_admin_thread()`
  (nvme_admin.c:104-110) sleeps forever on `admin_lk`/PROBED → `nvme_pci_detach` never
  returns → `kldunload`/devd teardown/system shutdown hang in `nvwend`; the 1 hz loop in
  the thread also stops servicing `ADMIN_SIG_REQUEUE`, so deferred BIOs sleep forever
  (stalled I/O paths pile up). No watchdog fires (the thread sleeps legally).

## Threat
DoS from a misbehaving controller (same trust boundary as DF-1813/DF-2512): host wedge at
detach/shutdown, unkillable kernel thread + blocked module unload. No memory corruption.

## PoC
Not drivable on the audit guest: QEMU 7.2's nvme device model always completes submitted
admin commands; making it stall requires a patched emulator (none available on this host).
`untested` (analysis-certain).

## Fix sketch
Bound the wait (e.g. 30–60 s), then transition `sc->admin_func = nvme_admin_state_failed`,
issue a controller reset (CC.EN toggle) or detach the device, and wake/abort waiters.