At least one loop, but it could be the trivial one (ideally?): take the trivial case where the hash is simply a unit cyclic shift of the first N-bits -- there's

At least one loop, but it could be the trivial one (ideally?): take the trivial case where the hash is simply a unit cyclic shift of the first N-bits -- there's just the full loop.