# DF-3718 VERDICT

**Status: inconclusive** (hardware-gated, family convention — cf. DF-3680
Low/certain, DF-3714 Low/certain), **confidence: certain** source-level.

## Source proof

- `mcp_idx` originates from the NIC-DMA'd `mcp_irq_data.send_done_count`
  (read `be32toh(stats->send_done_count)` at if_mxge.c:2695/2767/2844,
  cast `(int)` and passed at :2700/:2770/:2847).
- `mxge_tx_done` (:2364-2415) loops `while (tx->pkt_done != mcp_idx)` with
  no relation to `tx->req` — the driver's own knowledge of queued
  descriptors.  Free path per iteration: `bus_dmamap_unload` + `m_freem`
  on any non-NULL `info[idx].m` (:2381-2387).
- Forward-walk consequence A: descriptors still owned by the NIC get their
  maps unloaded and mbufs freed → device DMA into freed memory.
- Consequence B: `pkt_done` advances only on non-NULL m; after one
  revolution all slots are NULL → permanent interrupt-context spin under
  `tx_serialize` (and `main_serialize` for MSI/legacy paths, :2737) →
  interface and any serializer-acquiring threads wedge.

## Not reproduced

Guest has no Myricom device (see env.txt); the stats block is
device-written.  No software-only trigger.

## Fix

`fix.diff`: occupancy guard `if (tx->done >= tx->req) break;` + warning.
Mitigates the infinite spin; full validation of the counter against req is
the watchdog's job. fix_status=not_testable (no hardware).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.