BUILD_RC=0
== if_emx.c bound-math harness (guest has no emx hardware; source-line replica; [A]=DF-1197 known, excluded) ==

--- [B] emx_rxeof descriptor-length trust (if_emx.c:3369-3413) ---
[B] max_frame_size=1518 (trim=2, usable=2046), desc_len=1500 (EOP)
  [ok     ] len within posted span
[B] max_frame_size=1518 (trim=2, usable=2046), desc_len=65535 (non-EOP fragment)
  [OVERFLOW] m_len=65535 claims 63489 bytes past the 2046-byte posted cluster: kernel heap OOB read of up to 63489 bytes per descriptor
[B] max_frame_size=1518 (trim=2, usable=2046), desc_len=65535 (EOP)
  [OVERFLOW] m_len=65535 claims 63489 bytes past the 2046-byte posted cluster: kernel heap OOB read of up to 63489 bytes per descriptor
[B] max_frame_size=9234 (trim=0, usable=2048), desc_len=2048 (non-EOP fragment)
  [ok     ] len within posted span
[B] max_frame_size=9234 (trim=0, usable=2048), desc_len=65535 (EOP)
  [OVERFLOW] m_len=65535 claims 63487 bytes past the 2048-byte posted cluster: kernel heap OOB read of up to 63487 bytes per descriptor

--- [C] emx_tx_collect TDH walk (if_emx.c:2817-2855) ---
[C] num_tx_desc=512, next_tx_to_clean(first)=0, raw TDH register=0x64 -> int tdh=100
  in-range TDH: normal cleanup, no issue
[C] num_tx_desc=512, next_tx_to_clean(first)=0, raw TDH register=0x1000 -> int tdh=4096
  TDH out of ring range: walked 4194304 descriptors (8192 full ring wraps) without reaching TDH -> unbounded loop under the TX serializer
  [OVERFLOW] KKASSERT(num_avail<num_tx_desc) fires on INVARIANTS builds (:2835); production: serializer-held forever-spin + every tx_buf freed on pass 1
[C] num_tx_desc=512, next_tx_to_clean(first)=0, raw TDH register=0xffffffff -> int tdh=-1
  TDH out of ring range: walked 4194304 descriptors (8192 full ring wraps) without reaching TDH -> unbounded loop under the TX serializer
  [OVERFLOW] KKASSERT(num_avail<num_tx_desc) fires on INVARIANTS builds (:2835); production: serializer-held forever-spin + every tx_buf freed on pass 1

5 overflow/spin class(es) demonstrated in bound math
HARNESS_RC=1