# DF-3720 VERDICT

**Status: inconclusive** (hardware-gated), **confidence: certain**
source-level.

## Source proof
- Every locus in the README table: cmd.data0 (device response) -> pointer
  into sc->sram -> unconditional write.  No sram_size comparison anywhere
  in mxge_reset (:1207-1215), mxge_slice_open (:3255-3283), or the RSS
  table/key writes (:3362-3364, :3379-3384).
- The check pattern demonstrably exists in-file: mxge_adopt_running_firmware
  validates its device offset against sc->sram_size at :867.
- int16_t mask/cl_size (if_mxge_var.h:65-66) fed by device ring sizes
  (:3960, :3194-3196) -> entries >= 32768 wraps negative (:3007-3009).
- Sinks are reachable on every interface up/reset (attach does reset+open),
  and intr_coal_delay_ptr is writable live by root via sysctl (:1339).

## Not reproduced
No Myricom device on the guest (env.txt); offsets come from the device.

## Fix
fix.diff: mxge_sram_range_valid() applied at all four loci (git apply
--check clean). fix_status=not_testable (no hardware to build against).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.