{"finding_id":"DF-4860","status":"untested","attempts":0,"reproduced":0,"impact":"dos","confidence":"certain","verdict":"Hardware-gated: the TIS transmit path holds dev_lock exclusively and (1) busy-spins up to 750,000 DELAY(1)+MMIO iterations per burst chunk in wait_for_burst (~750ms+ CPU, multiplied by alternating burst=0 stalls), and (2) tsleeps WITHOUT PCATCH for up to the command timeout - which tpm20_get_timeout selects from the FULLY USER-CHOSEN command code: any TPM_CC_Create/CreatePrimary/CreateLoaded pins the thread unkillable in D-state for 40s while holding dev_lock, starving all other /dev/tpm0 users and shutdown. The TIS twin of DF-1991 plus the new busy-spin detail. Root/wheel cdev or hostile TPM. PCATCH + yield-style burst polling fix.","exploit_chain":"root writes a Create*-coded command against a stalled TPM -> 40s unkillable D-state under dev_lock + ~750ms CPU spin per burst -> cdev and shutdown starvation","evidence":"findings/poc/DF-4860/ (this verdict)","kernel_refs":["sys/dev/crypto/tpm/tpm_tis.c:284-291","sys/dev/crypto/tpm/tpm_tis.c:258-272","sys/dev/crypto/tpm/tpm_tis.c:441-442"],"guest_uname":"","code_hash":""}