DF-4160 — Unbounded PHY-reset poll in xe_mii_init()

File: sys/dev/netif/xe/if_xe.c:1637-1639 · Low · CWE-835 · hardware-gated

while(xe_phy_readreg(scp, PHY_BMCR) & PHY_BMCR_RESET); has no timeout and runs in crit_enter() + ifnet serializer at PCMCIA card insertion (xe_attach → xe_init, if_xe.c:397) and on every interface up. A PHY that acks MII but never clears RESET (faulty or malicious card — PCMCIA is attacker-insertable hardware) hangs the kernel permanently.

• Full analysis: VERDICT.md
• Fix: fix.diff (bounded poll, stuck PHY treated as absent → existing 10Mbit fallback path)
• No runtime verification possible: the QEMU audit guest has no PCMCIA/Xircom hardware. Status untested, per-audit convention for hardware-gated DoS findings.

DF-4160 — Unbounded PHY-reset poll in xe_mii_init(): attach/init hard hang

File: sys/dev/netif/xe/if_xe.c:1637-1639 · Severity: Low · CWE-835

Root cause

/* Reset the PHY */
xe_phy_writereg(scp, PHY_BMCR, PHY_BMCR_RESET);
DELAY(500);
while(xe_phy_readreg(scp, PHY_BMCR) & PHY_BMCR_RESET);   /* if_xe.c:1639 */

The poll has no iteration budget, no timeout, and no bailout. It executes:

• during xe_attach() → xe_init() (if_xe.c:397) — i.e. at PCMCIA card insertion / first ifconfig xe0 up — inside crit_enter() and the ifnet serializer, and
• on every later interface up-transition.

A PHY that acknowledges MII transactions but never clears PHY_BMCR_RESET (e.g. broken silicon, or a deliberately malicious PCMCIA card — the card is external, attacker-insertable hardware) pins the kernel in this loop forever: crit section + serializer held, CPU spinning on bit-banged MDIO. The system hangs at card insertion with no watchdog able to fire.

Note the escape hatches that do NOT save you: if the MII transaction fails to ack, xe_phy_readreg() returns 0 (xe_mii_readreg zeroed mii_data, ack failure returns garbage-free 0) and the loop exits — the hang requires a PHY that acks and keeps reporting RESET. That is exactly the "present but stuck" case a hostile or faulty card produces.

Fix

fix.diff bounds the poll (1000 × 1 ms) and treats a stuck PHY as absent (xe_mii_init then returns 0 → scp->phy_ok = 0), which the driver already handles gracefully (10Mbit-only fallback in xe_setmedia_serialized).

Verification

Hardware-gated (needs a Xircom-class PCMCIA adapter with a misbehaving PHY); no such hardware exists in the QEMU guest, so no runtime verification is possible. Source-level certainty: the loop body and exit condition are fully visible; no hidden bound exists. FreeBSD 10.3's copy of this driver carries the identical unbounded loop (shared 1999-vintage bug).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.