dissect_tiff() follows the TIFF Image File Directory (IFD) chain by repeatedly calling dissect_tiff_ifd() with the 32-bit "next IFD" offset it reads verbatim from the input. There is no visited-offset set, no requirement that the offset advance, and no iteration cap, so a TIFF whose IFD points its next-IFD field back at itself makes the walker loop over the same bytes forever. A bounds exception cannot rescue it, because the crafted offset is deliberately in bounds — the whole PoC is 14 bytes and the IFD it points at is the one already being parsed.
The dissector is reachable in the default configuration: directly, via the default-enabled wtap_file heuristic when a .tif is opened, and from ordinary captured traffic via the image/tiff media_type entry (e.g. an HTTP/WSP/MIME body).