The vulnerability manifests in WebSocket frame processing loops that lack termination checks after non-clean TCP closures. AbstractReceiveListener.handleEvent is the primary entry point for frame processing on IO threads, making it the most likely candidate for the infinite loop. WebSocketChannel.receive() is also implicated as it directly interacts with the channel's read operations. Both functions would appear in stack traces during exploitation due to their role in the IO thread processing loop. The confidence levels reflect the direct involvement of these functions in the vulnerable workflow described in the CVE.