# DF-3369 — bdg_netmap_rxsync(): reserved+avail uint32 wrap defeats the sanity check → non-terminating loop under exclusive q_lock

**Target:** `sys/net/netmap/netmap_vale.c:1502-1528` (`bdg_netmap_rxsync`, the
`nm_rxsync` of every VALE port — netmap_vale.c:1551 — reached from
`NIOCRXSYNC` on the port's mmap()ed ring).

## The bug

`ring->reserved` and `ring->avail` are user-writable shared-memory fields.
The only sanity check is

```c
	if (resvd > 0) {
		if (resvd + ring->avail >= lim + 1) {   /* netmap_vale.c:1503 */
			ring->reserved = resvd = 0;
		}
		k = (k >= resvd) ? k - resvd : k + lim + 1 - resvd;
```

`resvd + ring->avail` wraps uint32: **reserved=0xFFFFFFFF, avail=1 → sum 0**,
check false, reserved kept; then `k = cur + lim + 1 - resvd` = `cur + 1025`
(mod 2^32) — outside `[0..lim]`.  The release loop
`for (n = 0; j != k; n++) { ...; j = nm_next(j, lim); }` (netmap_vale.c:1515)
can never terminate because `j` only ever takes values in `[0..lim]`.
The loop runs with `kring->q_lock` held `LK_EXCLUSIVE` (acquired
netmap_vale.c:1493): the NIOCRXSYNC thread spins forever, never returns to
user mode (unkillable), and the kring lock is never released.

Sibling of DF-3332 (netmap.c `netmap_grab_packets`, same *class* of
unvalidated `ring->reserved`, different function/file/sink — that one
`k += n` sign error; this one the wrap in `bdg_netmap_rxsync`).

## Platform note

Netmap does not compile on this tree (established platform fact); verified
via verbatim-function KLD: `df3369_kmod.c` copies `bdg_netmap_rxsync`
**verbatim** (real `lockmgr`/`q_lock`; stubs for `BDG_NMB`/reinit that cannot
influence the control flow; a clearly-marked bail-out counter replaces the
infinite spin so the guest survives the demonstration).

## Build / run (guest, root)

```
cd /root/df3369 && make && make fixed
./run.sh vuln 0    # control reserved=4: terminates in 1 iteration
./run.sh vuln 1    # reserved=0xFFFFFFFF: NON-TERMINATING (1e6 iters, k=1030 outside ring)
./run.sh fixed 1   # reserved rejected ("XXX invalid reserve/avail"), terminates in 5
```

## Expected results

See `run.log` — exact predicted arithmetic observed:
`k = 1030` for `cur=5, lim=1023, reserved=0xFFFFFFFF`.