# run:   2026-07-17T12:38:44Z
[DF-1381] vge_rx_list[256] DMA alloc; refill idx=2, consumed=4
[DF-1381] loop bound = idx - consumed = 2 - 4 = -2 (signed)
[DF-1381]   i=2 -> vge_rx_list[2]: in-bounds OWN set
[DF-1381]   i=1 -> vge_rx_list[1]: in-bounds OWN set
[DF-1381]   i=0 -> vge_rx_list[0]: in-bounds OWN set
[DF-1381]   i=-1 -> vge_rx_list[-1]: write vge_sts |= OWN at byte offset -16 (BEFORE the DMA allocation!)
[DF-1381] worst-case (idx in {0,1,2,3}): up to 3 entries written BEFORE vge_rx_list -> 16..48 bytes of kernel heap corrupted before the RX ring
[DF-1381] BUG CONFIRMED: signed-i refill loop underflows to negative indices -> heap OOB write before the RX DMA ring
[DF-1381] FIX: use modular wrap for (i=idx, j=0; j<VGE_RXCHUNK; j++, i=(i-1+VGE_RX_DESC_CNT)%VGE_RX_DESC_CNT)
RUN_EXIT=0