When trying to do an I2C read that is getting NACK'd in the address phase, stm32_i2c_msg_read() will spin forever because RXNE will never be set. This causes the innermost loop to spin forever.
Similar to #8915, #7626 and commit 81cfdec, but this issue is in polling mode, not interrupt.