Summary

ehci_pci_take_controller at ehci_pci.c:517-518 has for(eecp=EHCI_HCC_EECP(cparams); eecp!=0; eecp=EHCI_EECP_NEXT(eec)) with NO iteration cap and NO cycle detection. Both head pointer (HCCPARAMS EECP field, bits 8-15 of MMIO DWORD at EHCI_HCCPARAMS read at :514) and every next pointer (eec bits 8-15, read via pci_read_config at :519) are fully attacker-controlled PCI device data. If device returns DWORD whose bits 8-15 (NEXT) equal current eecp and low byte (ID) != 0x01 (EHCI_EC_LEGSUP), eecp never changes and loop becomes zero-sleep CPU spin. Also reachable on USB resume via USB_TAKE_CONTROLLER from usb_bus_resume (usb_controller.c:537). Attacker position: malicious Thunderbolt/PCIe hot-plug device, compromised firmware, or VM host feeding crafted EHCI to guest. Impact: hard system hang (boot stall or CPU pin + watchdog trip). If LEGSUP ID with bios_sem!=0 and self-referential NEXT, inner while-loop bounds BIOS-wait to 5s but outer loop re-visits same entry -> throttled infinite loop. Same class in pci.c:ehci_early_takeover. Fix: add iteration cap (n<32) and alignment check.