{
  "finding_id": "DF-4979",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Distinct unbounded loop from DF-2026 (verified not fixed by a DF-2026 cap): on ENXIO/EBUSY from the first SMBus block read the code releases the bus, sleeps 10ms, and goto read_start retries forever - a stuck/malicious BMC (or SMBus controller fault) wedges the ssif kthread inside one request: queued+future IPMI ioctls block forever and the watchdog callout stops being serviced. Bounded-retry fix (~1s cap).",
  "exploit_chain": "BMC at the SSIF address answers READ_START with persistent EBUSY -> goto read_start loop never exits -> IPMI subsystem stall + watchdog neglect",
  "evidence": "findings/poc/DF-4979/ (this verdict)",
  "kernel_refs": [
    "sys/dev/misc/ipmi/ipmi_ssif.c:186-194",
    "sys/dev/misc/ipmi/ipmi_ssif.c:257"
  ],
  "guest_uname": "",
  "code_hash": ""
}