Does having an SHA256 hash compromise PBKDF2 secrecy?
If the party that controls the server also controls the client application then the server will always be able to retrieve the password. In that sense protecting against the server only works if very strict auditing is taking place, and then only maybe.

If the server receives a hash over the password then it can of course perform a (augmented) dictionary attack against the hash. When multiple hashes are collected then rainbow tables will also be an option. All the additional protection delivered by bcrypt of PBKDF2 will be null and void.

So yes, if the password could be found with an attack, and then PBKDF2 can be performed using the found password in your scheme. Very strong password will still offer protection against the server, of course.



PS No, the more iterations the better for PBKDF2. Cycles only occur after many more iterations, and are nothing to worry about here.