Unbounded unvalidated PCI extended-capability loop in ehci_pci_take_controller (DoS via malicious/fuzzed controller)

Summary

BIOS-handoff loop in ehci_pci_take_controller walks linked list of PCI extended capabilities whose pointers and contents entirely device-controlled with no upper bound on iterations and no validation that eecp points past standard 0x40 config header. eecp=EHCI_HCC_EECP(cparams) is 8-bit device-authored value. Loop advances from EHCI_EECP_NEXT(eec)=(eec>>8)&0xff where eec=pci_read_config(self eecp 4) again controller-authored. No iteration counter so cycle (A.NEXT=B B.NEXT=A) or self-ref (X.NEXT=X) loops forever. No lower-bound check so controller may set eecp<0x40. Loop body also contains 5-second usb_pause_mtx busy-wait per iteration amplifying non-terminating walk into hard hang. Malicious USB controller peripheral PCIe/Thunderbolt hot-plug emulated EHCI in VM.