WDT causes reboot loop when underflow occurred once

By default, in my application, WDT is disabled by default and should only be started when instructed to do so by the user.

After the WDT is started by a user, the mcu will be reset after an underflow occurs. After resetting the mcu, the mcu constantly restarts. However, the user hasn't enabled the WDT after the reset.

The OFS0 register is set as follows: