# DF-5626 — ppb_poll_bus() PPB_POLL path: uninterruptible busy-spin scaled by unclamped `max` (CPU livelock primitive)

File: `sys/bus/ppbus/ppb_base.c:60-67`; in-tree argument suppliers
`sys/bus/ppbus/ppb_1284.c:58` (max=4), `:64` (max=100), `:704` (max=40,
PERIPH_1284-gated).

## Build (inside the DragonFly guest)

```
sh build.sh     # compiles VERBATIM /usr/src/sys/bus/ppbus/ppb_base.c into ppbbasehx.ko
```

## Run (inside the guest)

```
sh run.sh       # NOTE: the max=100 test pins one CPU for ~20 s in this guest
```

## Expected (decisive lines, see run.log)

```
PPBHX: DF-5626 busy  max=5  : ret=35 rstr_reads=50000  wall=1000010us
PPBHX: DF-5626 busy  max=100: ret=35 rstr_reads=1000000 wall=19670196us
PPBHX: DF-5626 sleep ctrl max=3: ret=35 rstr_reads=10002 wall=240003us
```

When `how & PPB_POLL`, the outer loop runs `max` times and each iteration
executes 10000 x (status-register read + `DELAY(1)`): a pure busy loop with
no `tsleep`, no signal checkpoint, and no clamp on `max`.  Proven by the
port-read counter: exactly `10000` register reads per `max` unit (a
sleeping poll reads the status once per 10 ms window — the control line
shows 10002 reads for the identical wall-order wait without PPB_POLL).
Measured wall time on this 6-vCPU guest: `max=5` (nominal 50 ms) pins the
CPU for ~1.0 s; `max=100` — `do_peripheral_wait()`'s exact in-tree
argument (ppb_1284.c:64) — pins it for **~19.7 s** (DELAY(1)+dispatch
overhead ~20 us/iteration under QEMU; ~1 s on bare metal).

Reachability: ppi/lpt device nodes are 0600 root:wheel (ppi.c:164-166,
lpt.c:399-402), so the trigger is root-gated; the 1 s `max=100` path is
additionally behind the non-GENERIC `PERIPH_1284` option (its ppiwrite
entry is further dead per DF-4806).  The reachable-on-GENERIC spin is
`do_1284_wait`'s 40 ms per negotiation (lptread/ppiread/vpo paths).  Low
severity: root-triggerable CPU livelock windows; API export
(`sys/bus/ppbus/Makefile:13`) lets any KLD caller pass an arbitrary `max`
(security boundary for third-party ppbus controllers).

## Harness note

One shared KLD harness demonstrates DF-5625/5626/5627/5628; this pack's
lines are the `DF-5626` ones.