DF-1158 PoC verification — source-level trace of wpi_notif_intr index mask bug.

The driver is compiled into the X86_64_GENERIC kernel
(`sys/config/X86_64_GENERIC:272`) but no Intel 3945ABG WiFi HW is present in
the QEMU guest, so the vulnerable code path is not runtime-reachable here.
Verification is by source-level trace + build-validation of the fix.

## Bug location
- `sys/dev/netif/wpi/if_wpi.c:2208` — `hw = le32toh(sc->shared->next) & 0xfff;`
- `WPI_RX_RING_COUNT = 64` (`sys/dev/netif/wpi/if_wpireg.h:25-30`)
- `sc->shared->next` is firmware-DMA-written (`if_wpi.c:5347-5348`, `if_wpireg.h:233-237`)

## Mechanism
The kernel trusts 12 bits of a firmware-DMA word but iterates `rxq.cur` modulo
64, so any firmware value > 63 in the low 12 bits makes the while-loop at
`if_wpi.c:2211` non-terminating. Kernel interrupt handler hangs → DoS.

## Reproduce
1. Apply `fix.diff` to /usr/src.
2. `cd /usr/src/sys/dev/netif/wpi && make KMOD=if_wpi`  →  if_wpi.ko builds clean.
3. Runtime test requires Intel 3945ABG HW (not present on this guest).

See `VERDICT.md` for the full analysis.