DF-4393
Unbounded firmware-status spin and 20-second busy-wait in the OCR path execute in the watchdog callout while holding mfi_io_lock - single stuck firmware wedges softclock and all card I/O
Summary
The OCR path busy-waits 20 seconds then spins indefinitely on the RSR bit with no timeout; invoked from the reset holding mfi_io_lock in callout context - a firmware that never clears the bit parks the softclock thread forever with the lock held, permanently stalling all callouts system-wide. The neighboring reset sequencer bounds its waits, showing the omission is accidental. Bound-the-handshake fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4393 Β· 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 141 B | β raw | |
| verdict.json | file | 870 B | view raw |
README.md
file
β download raw
DF-4393
Hardware-gated finding - PoC skipped per contract. Source citations in the pass-2 result block.
Fix: see pass-2 result block fix
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
see pass-2 result block fix
source-only
per-fix-DF-4393
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; path:line citations in pass-2 result block
Verdict
source-verified; hardware-gated
No comments yet.