DF-2470 -- Infinite loop in isp response-queue pointer update (target mode)

Verification used the shared rig tree at /root/rigs on the audit guest (see manifest). The rig for this finding: dfv_ispt (rig.c = harness, gen.sh = verbatim extractor, dfv_*_extract.h = generated production text). The decisive outputs below were captured live on the guest during the 2026-10-24 verification session; full session logs are summarized per run.

Build

sh build.sh            # extracts verbatim driver text + builds the KLD

Run (guest, root)

kldload ./dfv_rig.ko

kldload dfv_ispt.ko; sysctl kern.dfv_ispt_run=2; sleep 4; sysctl -n kern.dfv_ispt_status

Expected

run.log: watchdog - dispatch thread STILL INSIDE isp_intr response loop after 3s, done=0; fixed run: DF2470 loop EXITED immediately.

Fix validation

fix.diff converts the while loop to a single guarded advance; fixed rig run exits immediately.

Verdict: reproduced / impact=denial_of_service (see verdict.json, VERDICT.md)

DF-2470 verdict -- Infinite loop in isp response-queue pointer update (target mode)

status: reproduced reproduced: 1 impact: denial_of_service confidence: certain attempts: 1 runtime_sec: 300

The verbatim response-loop fragment (isp.c:5113-5124, extracted by exact line range) never terminates once entered: the loop body only assigns optr and never modifies tsto or oop, and tsto != oop is the entry condition the code itself describes (the isp.c:5107 comment - somebody reachable via isp_handle_other_response may have updated the queue pointer). The compiled-with-ISP_TARGET_MODE verbatim isp_handle_other_response (whose rig interposition of isp_target_notify advances the output pointer exactly per the target-mode contract) drives tsto != oop; a dispatch thread entered the loop and a 3s watchdog proved it still inside - a permanent hang of the interrupt context. Config gate verified: no in-tree build defines ISP_TARGET_MODE (grep over sys/), so every stock kernel and the stock isp.ko are unaffected; the defect is real for anyone enabling target mode. Fix (single-step optr advance) A/B: the dispatch thread exits the fragment immediately (loop EXITED printed; the watchdog message in the fixed run is a known heuristic false positive because the adapted return path skips the done-flag).

Evidence (decisive lines)

dfv_ispt: DF2470 watchdog: dispatch thread STILL INSIDE isp_intr response loop after 3s -- NON-TERMINATING (interrupt-context hang) ; DF2470 done=0 reported=1 --- fixed source A/B --- dfv_ispt: DF2470 loop EXITED done=0 <- thread completed instantly

Exploit chain / privesc assessment

no privesc - interrupt-context hang (system freeze) on a config-gated path.

Fix + A/B

fix.diff converts the while loop to a single guarded advance; fixed rig run exits immediately.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.