# DF-3428 — generic_netmap_rxsync `reserved` wrap → infinite kernel loop

## Build / Run
- `./build.sh` — module build attempt (fails on this tree; shared
  `netmap_build.log`).
- `./run.sh` — trigger sketch only; module absent.

## The math (certain from source)
`ring->reserved` and `ring->avail` are mmap'd userspace-writable u_int32
(`sys/net/netmap/netmap.h:221-223`).  With `lim = nkr_num_slots - 1 = 1023`:

- `resvd = 0xFFFFFFFF`, `avail = 1` → `resvd + ring->avail == 0` (mod 2^32)
  → validation at `netmap_generic.c:694` (`>= lim + 1`) **passes**.
- `k = cur ≤ lim < resvd` → else-branch: `k = cur + 1024 + 1 - 0xFFFFFFFF`
  ≡ `cur + 1026` (mod 2^32) → `k ∈ [1026, 2049]`, always **> lim**.
- Release loop `for (n = 0; j != k; n++)` (`:702`) — `j` only ever takes
  values in `[0, lim]` → **never terminates**.

Locking: `generic_netmap_rxsync` runs under the kring busy/lock protocol
(`netmap.c:1474` ioctl path / `netmap.c:1768` poll path, `nm_kr_get` →
`q_lock`), so the looping thread is unkillable and every other user of the
ring blocks: unkillable local DoS. Slot writes stay in-bounds (livelock, not
corruption).

## Precondition
`/dev/netmap` open (created `0660 root:wheel`, `netmap.c:2237`) — same gate
as DF-0616/DF-3426. Severity Medium: local DoS behind a privileged device.

## Verdict
`build_failed` — module unbuildable on this tree (identical blocker as
DF-3426/3427); arithmetic verified by hand and by contrast with the
non-looping host-ring variant (`netmap.c:886-930`).