{
  "finding_id": "DF-4699",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Analysis-certain robustness/DoS defect: nvme_wait_request() has no deadline; every admin-thread state function blocks in it forever on a controller that never completes a command, holding admin_lk. PROBED is then never set, so nvme_stop_admin_thread() (and thus kldunload/device detach/system shutdown) hangs forever in nvwend, and the requeue service stops. Trigger requires a stalled/malicious controller; QEMU 7.2 always completes admin commands, so PoC left untested by design.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4699/README.md; nvme.c:549-554, nvme_admin.c:104-110,158,229-234",
  "kernel_refs": [
    "sys/dev/disk/nvme/nvme.c:549",
    "sys/dev/disk/nvme/nvme.c:553",
    "sys/dev/disk/nvme/nvme_admin.c:104",
    "sys/dev/disk/nvme/nvme_admin.c:158",
    "sys/dev/disk/nvme/nvme_admin.c:234"
  ],
  "poc_changes": "no seed; analysis-only pack",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "trigger cannot be generated by the available device model (QEMU 7.2 always completes admin commands)",
  "fix_evidence": "",
  "notes": "Low severity: device-gated DoS (wedge at detach/shutdown); no memory corruption.",
  "recommended_fix": "Bound admin waits with a deadline and fail over to nvme_admin_state_failed + controller reset instead of sleeping forever."
}