I am reluctant to go for the direct "wtf?!" response, because as above, it bruises egos and people get defensive - and that is unhelpful to actually resolving issues. I tend to phrase it as "Perhaps I'm confused, but...". (One advantage of this is that sometimes, I am wrong, and this gives someone an opportunity to explain why, and in the process hopefully re-examining their thought process and testing it just in case.) I think I caught that pattern, as well as excessive usage of "though", from a good friend. One interpretation of this is that perhaps I've spent nigh-on 2½ decades being confused. <g>
There is, however, a place for the genuine WTF. I reserve it for "there's no way you could be that stupid" situations, like someone cheerfully telling me about the 256-bit encryption they used, and my discovering it's RSA-256.
The management-by-Perkele has however seemed to work to keep the Linux kernel clean up 'til now, although they don't really want to insult people.
You can phrase things directly, even adding minimizing language (to save face), but be clear about the problem during the review.
I second this notion. When you have doubt whether a loop terminates the question is appropriate but next to something as obvious as "for(;;) {}" it will simply sound insulting to the recipient's intelligence.
Also, think that the programmer might have already thought of that issue. Does that loop really never terminates? Isn't that test obvious/really needed?
I prefer the strategy of wrapping my sentences in things like, "I think" or "I prefer".
So, I'd write, "This loop doesn't seem to terminate." or "I think that this condition needs a test." It's an implicit admission that I could be wrong and an invitation to push back. Just as often, I'll walk over and say, "Could you explain why you did that to me?" This is especially acceptable when it's agreed that a good review requires the reviewer understand what's going on.