{
  "finding_id": "DF-5359",
  "title": "uipaq_attach burns up to ~12.8s of the per-bus USB explore thread on an unresponsive crafted device: 64 unconditional retries of the magic control request (100ms timeout + 100ms pause each), no early-out on stall or device-gone",
  "verdict": "untested",
  "impact": "dos (bounded, crafted-USB-device physical precondition)",
  "confidence": "certain",
  "reproduce": {
    "build": "n/a (hardware precondition - see README.md)",
    "run": "plug a scripted USB device presenting a uipaq_devs[] VID:PID (e.g. 0x049f:0x0032) whose EP0 NAKs/STALLs SET_CONTROL_LINE_STATE; expect a 6-13s enumeration stall per insertion",
    "expected": "~6.4s (stall/gone device) to ~12.8s (NAK-ing device) delay of all hub-event processing on that bus, repeatably via replug"
  },
  "kernel_refs": [
    "sys/bus/u4b/serial/uipaq.c:1124-1136",
    "sys/bus/u4b/serial/uipaq.c:150-1061",
    "sys/bus/u4b/usb_device.c:1286-1345",
    "sys/bus/u4b/usb_device.c:1324",
    "sys/bus/u4b/usb_hub.c:995-1090"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "fix.diff",
    "verdict.json",
    "manifest.json"
  ]
}