# DF-1461: txp_rxbuf_reclaim UAF / double-free

## Finding
**DF-1461** (High): `txp_rxbuf_reclaim` in `sys/dev/netif/txp/if_txp.c`
frees a persistent per-slot allocation (`struct txp_swdesc *sd`) in its
error path (lines 793–796), creating a use-after-free and double-free.

## Build
```sh
cc -O2 -Wall -o harness harness.c
```

## Run
```sh
./harness
```

## Expected output
The harness replicates the exact memory-management pattern of
`txp_rxbuf_reclaim` in userspace (malloc/free) to demonstrate the bug
without requiring the 3Com Typhoon NIC hardware:

```
--- Testing BUGGY txp_rxbuf_reclaim (if_txp.c:793-796) ---
...
  => BUG CONFIRMED: dangling pointer + UAF read + double-free

--- Testing FIXED txp_rxbuf_reclaim ---
...
  => FIX CONFIRMED: no double-free, no UAF
```

## Why a harness instead of a live trigger?
The `txp` driver (3Com 3cR990 "Typhoon", PCI vendor 0x10b7) is compiled
into the X86_64_GENERIC kernel (`device txp` in the config), but there is
**no 3Com hardware** on the QEMU/KVM guest. The driver never probes or
attaches, so `txp_rxbuf_reclaim` is unreachable at runtime. The bug is
confirmed by source-level tracing and demonstrated by a pattern-faithful
harness.

## Reproduction
```sh
./build.sh && ./run.sh
```