--- device presence ---
vtnet0 lo0
0
0
-r-xr-xr-x  1 root  wheel  647440 Jun 29 14:24 /boot/kernel/if_em.ko
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

--- bound-math harness (em_bounds_harness) ---
== if_em.c bound-math harness (guest has no em hardware; source-line replica) ==

--- [A] em_newbuf ETHER_ALIGN trim vs RCTL_SZ_2048+LPE (if_em.c:3378-3379, :3607-3632) ---
[A] MTU=1500 (max_frame_size=1518, trim=2, LPE=0), frame=3000 B, mapped=2046 B, first-desc fill=2048 B -> cluster write span [2, 2050)
  [skip]   trim/LPE do not coexist (safe config)
[A] MTU=2000 (max_frame_size=2018, trim=2, LPE=1), frame=3000 B, mapped=2046 B, first-desc fill=2048 B -> cluster write span [2, 2050)
  [OVERFLOW] 2-byte attacker-controlled DMA write past 2048-byte mbuf cluster (first descriptor)
  [OVERFLOW] stack-side m_len read span past cluster (em_rxeof:3738)
[A] MTU=9000 (max_frame_size=9018, trim=0, LPE=1), frame=9026 B, mapped=2048 B, first-desc fill=2048 B -> cluster write span [0, 2048)
  [skip]   trim/LPE do not coexist (safe config)

--- [B] em_rxeof descriptor-length trust (:3692-3761) ---
[B] desc_len=1500 (EOP): driver len=1496 usable cluster span=2048
[B] desc_len=65535 (non-EOP fragment): driver len=65535 usable cluster span=2048
  [OVERFLOW] mp->m_len=65535 claims 63487 bytes past the 2048-byte cluster: kernel heap OOB read of up to 63487 bytes per descriptor (ether_input/BPF/forwarding consumers)
  [OVERFLOW] error-path last_byte probe OOB (em_rxeof:3715)
[B] desc_len=65535 (EOP): driver len=65531 usable cluster span=2048
  [OVERFLOW] mp->m_len=65531 claims 63483 bytes past the 2048-byte cluster: kernel heap OOB read of up to 63483 bytes per descriptor (ether_input/BPF/forwarding consumers)
  [OVERFLOW] error-path last_byte probe OOB (em_rxeof:3715)

--- [B2] prev_len_adj underflow (:3697-3699, :3754-3758) ---
[B2] prev frag m_len=0, EOP desc_len=2 -> prev_len_adj=2 -> lmp->m_len = -2
  [OVERFLOW] negative m_len injected into RX mbuf chain

--- [C] em_tx_collect TDH walk (:3284-3322) ---
[C] num_tx_desc=512, next_tx_to_clean(first)=0, raw TDH=100
  in-range TDH: normal cleanup, no issue
[C] num_tx_desc=512, next_tx_to_clean(first)=0, raw TDH=4096
  TDH out of ring range: walked 1048576 descriptors (2048 full ring wraps) without reaching TDH -> unbounded ISR-context loop
  [OVERFLOW] KKASSERT(num_avail<num_tx_desc) fires on INVARIANTS builds (:3302); production: permanent serializer-held spin

8 overflow class(es) demonstrated in bound math
RUN_RC=1