================= DF-3757 RUN =================
/bin/sh: /tmp/df3756/srom_mediainfo_model: not found
tulip_tx_intr reclaim attempt: 0 descriptors reclaimed (all 128 still chip-owned)
guard `ri->ri_free == 1' did NOT catch ri_free == 0 -> falls through
ri->ri_free = -1   (UNDERFLOW: accounting now negative)
setup frame programmed over descriptor 0 (chip-owned before write: YES — ownership violation)
in-flight packet descriptor now tagged TxSETUPPKT|TxLASTSEG: tulip_tx_intr SETUPPKT branch (if_de.c:3176) will skip m_freem() -> mbuf+cluster leak
next tulip_txput(): free = ri->ri_free = -1 (negative), `if (free == 0)' reclaim at if_de.c:3445 SKIPPED
KASSERT(eop->di_mbuf == NULL) at if_de.c:3544 fires on INVARIANTS kernels once the clobbered desc is re-used

SUCCESS-CRITERION: ri_free underflows to -1 and a chip-owned descriptor is reprogrammed -> logic model of if_de.c:3633 defect CONFIRMED
exit=0