Summary

After an 8-second tsleep, issue_cx28975_cmd enters a tight while (p->out_ack == _ACK_NOT_COMPLETE) ; spin with no timeout, no cpu yield, and no escape if the CX28975 never updates out_ack. Any condition that leaves the chip in ACK_NOT_COMPLETE (bad firmware upload from DF-1651, ESD, broken PCIe link, malicious peer confusing the transceiver) permanently wedges the calling kernel thread, which is holding the interface serializer — taking the whole net stack CtrlQ with it.

Root cause

sys/dev/netif/sbsh/if_sbsh.c:1042-1046:

if (tsleep(sc, 0, "sbsh", hz << 3))
    return (-1);

while (p->out_ack == _ACK_NOT_COMPLETE)
    ;                                 /* FIXME ! */

The FIXME ! comment shows the author knew this was incomplete. The tsleep has an 8-second timeout (hz<<3) which is honored, but the subsequent spin loop has none. p->out_ack is a volatile MMIO byte read from the cx28975_cmdarea; if the device is stuck (e.g. because bad firmware was loaded via DF-1651, or because of a hardware fault), this loop runs forever with interrupts disabled on the serializer-held thread.

Threat model

Attacker position: root with SYSCAP_RESTRICTEDROOT (via SIOCLOADFIRMW, SIOCCLRSTATS, SIOCGETSTATS, or SIOCSIFFLAGS triggering sbsh_init/sbsh_stop — all of which call issue_cx28975_cmd). Once the chip is in a non-responding state (which can be engineerable by uploading deliberately-corrupt firmware via DF-1651), any subsequent ioctl that calls issue_cx28975_cmd hangs the calling kernel thread forever. Because the if_serializer is held, the entire network stack serializer for this interface stalls, blocking all interface operations systemically.

Practical impact: permanent local DoS requiring reboot. Confidence certain (the missing timeout is unambiguous in source).

PoC

Leverage DF-1651 to first put the chip in a broken state (load truncated firmware so the device is mid-download when the next command is issued), then issue a benign SIOCCLRSTATS which calls issue_cx28975_cmd at line 478:

int s = socket(AF_INET, SOCK_DGRAM, 0);
struct ifreq ifr; memset(&ifr, 0, sizeof(ifr));
strlcpy(ifr.ifr_name, "sbsh0", sizeof(ifr.ifr_name));
ioctl(s, SIOCCLRSTATS, &ifr);   /* never returns; system hangs on serializer */

Success: ioctl never returns; other operations against sbsh0 stack behind the same serializer stall.

Recommended fix

Bound the wait with a sane timeout and return error on exhaustion.

--- a/sys/dev/netif/sbsh/if_sbsh.c
+++ b/sys/dev/netif/sbsh/if_sbsh.c
@@ -1042,8 +1042,14 @@ issue_cx28975_cmd(struct sbsh_softc *sc, u_int8_t cmd,
    if (tsleep(sc, 0, "sbsh", hz << 3))
        return (-1);

-   while (p->out_ack == _ACK_NOT_COMPLETE)
-       ;                   /* FIXME ! */
+   {
+       int to = hz * 2;    /* bound the spin to ~2 seconds max */
+       while (p->out_ack == _ACK_NOT_COMPLETE && --to > 0)
+           DELAY(1000);
+       if (p->out_ack == _ACK_NOT_COMPLETE)
+           return (-1);
+   }

    if ((p->out_ack & 0x1f) == _ACK_PASS) {

A better fix would convert the entire command protocol to a tsleep/wakeup model driven by the EXT interrupt path, but the bounded spin above closes the hang window with minimal change.