=== DF-1461: txp_rxbuf_reclaim UAF / double-free harness ===

--- Testing BUGGY txp_rxbuf_reclaim (if_txp.c:793-796) ---
Call 1: rxbufprod=0, forcing MGETHDR failure...
  rc=-1, rxbufprod still =0 (NOT advanced)
  rb_sd[0] = 0x8004a02c0 (NOT NULLed — dangling pointer)
Call 2: rxbufprod=0 (same slot), reading rb_sd[0]...
  sd = rb_sd[0] = 0x8004a02c0 => UAF READ: sd->sd_mbuf deref = 0x0
Detach:
  detach: freeing rb_sd[0] — already freed in err_sd => DOUBLE-FREE
  => BUG CONFIRMED: dangling pointer + UAF read + double-free

--- Testing FIXED txp_rxbuf_reclaim ---
Call 1: rxbufprod=0, forcing MGETHDR failure...
  rc=-1, rxbufprod still =0 (OK, will retry)
  rb_sd[0] = 0x8004a02f0 (still valid — NOT freed)
  rb_sd[0]->sd_mbuf = 0x0 (NULLed — safe)
Call 2: rxbufprod=0, MGETHDR succeeds...
  rc=0, rxbufprod now =1 (advanced)
Detach:
  => FIX CONFIRMED: no double-free, no UAF