# DF-1381 — vge_newbuf RX-ring refill underflow OOB write (vge)

## Summary
`vge_newbuf` (`sys/dev/netif/vge/if_vge.c:1163`) uses a signed `int i` in a
`for (i = idx; i != idx - consumed; i--)` loop to set RX OWN bits 4 at a time.
When mbuf exhaustion under a flood desyncs `vge_rx_consumed` so it reaches 4 at
an `idx ∈ {0,1,2,3}`, `idx-4` is negative and `i` underflows to -1/-2/-3,
writing `vge_sts |= OWN` 16/32/48 bytes **before** the `vge_rx_list` DMA
allocation. Remotely triggerable on a host with a VIA vge NIC. No vge NIC on
the audit guest (only vtnet0).

## Reproduce
```
./build.sh   # cc -O2 -o harness harness.c
./run.sh     # ./harness
```
Expected: `i=-1 -> vge_rx_list[-1]: write ... at byte offset -16 (BEFORE the DMA
allocation!)`, `worst-case ... 16..48 bytes of kernel heap corrupted before the
RX ring`, `BUG CONFIRMED`. Object-level proof — vge does not attach on the QEMU
guest.

## Fix
`fix.diff` replaces the signed loop with a modular-wrap count loop.
Validated to apply + compile (`if_vge.ko`, clean build rc=0).