# DF-5248 — `run_drain_fifo()` never terminates on failed/lying TX-stat reads

`sys/bus/u4b/wlan/if_run.c`

## What

`run_drain_fifo()` (if_run.c:2503-2563) polls the device TX-status FIFO
in an unbounded `for(;;)`, ignores the return value of `run_read()`
(2515), and `run_read()` returns `0xffffffff` on error (1254) which has
`RT2860_TXQ_VLD` (bit 0, if_runreg.h:664) set. Result: the loop can
never exit while USB control reads fail (unplugged/wedged device) or
while a hostile device always reports a valid FIFO entry. Each iteration
costs up to 10 × 250 ms of control-request retries (1223-1242), wedging
the net80211 task thread; `run_detach()`'s `ieee80211_draintask()`
(879-880) then hangs `device_detach()` forever.

## Repro (logic-level, hardware-gated)

    build: cc -O2 -o drain_fifo_loop drain_fifo_loop.c   (build.sh)
    run:   ./drain_fifo_loop                              (run.sh)

Both scenarios (persistent read error; hostile always-VLD device) hit
the 1e6-iteration cap without terminating — the kernel has no cap.

## Verdict

`inconclusive` (no run(4) hardware attachable to the QEMU guest),
confidence `certain` on the control-flow logic itself.