{
  "finding_id": "DF-3758",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "tulip_rx_intr()s replenish loop panics unconditionally when bus_dmamap_load_mbuf(BUS_DMA_NOWAIT) fails (if_de.c:3139, marked /* XXX */ by the author). The RX data tag is capped at BUS_SPACE_MAXADDR_32BIT (if_de.c:3945-3947), so on hosts with memory above 4 GB high clusters need bounce pages and the NOWAIT load can fail under DMA-map/memory pressure while a local user drives receive traffic -> kernel panic (local DoS). The correct degrade pattern exists 12 lines earlier for m_getcl failure (if_de.c:3114-3122: fillok=0, TULIP_RXBUFSLOW, retry via watchdog if_de.c:3806); the map-load failure should do the same. Guest evidence (run.log): panic string live in /boot/kernel/kernel, source confirmed in /usr/src, driver compiled into X86_64_GENERIC but zero attached instances (hw.de.* count=0, no 0x1011 PCI devices) -> path cannot execute on this rig, hence not_reproduced; expected impact on de-equipped hosts is a reliable-if-probabilistic unprivileged local panic.",
  "exploit_chain": "",
  "evidence": "run.log: strings /boot/kernel/kernel shows 3 tulip_rx_intr hits; if_de.c:3127-3145 excerpt with panic(\"tulip_rx_intr\") at 3139; kldstat pci/if_de: 1 and hw.de.* sysctl OIDs: 0.",
  "kernel_refs": [
    "sys/dev/netif/de/if_de.c:3134-3140",
    "sys/dev/netif/de/if_de.c:3106-3122",
    "sys/dev/netif/de/if_de.c:3945-3947"
  ],
  "poc_changes": "No seed PoC; authored the shell evidence collector from scratch.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "sh panic_path_evidence.sh (no compile step)",
  "run_cmd": "sh panic_path_evidence.sh",
  "code_hash": "3e4ea11101a0150fe2151838e75ae14500b64ef0ce67ec98ae2215d4c1bc6143",
  "notes": "Requires de(4) hardware for actual panic reproduction; Medium per local-DoS rubric on de-equipped machines, hardware-gated on this guest.",
  "recommended_fix": "Replace panic() at if_de.c:3139 with m_freem(ms); fillok=0; TULIP_RXBUFSLOW; break \u2014 mirroring the m_getcl failure path.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (drop + back off instead of panic); not kernel-tested: no de(4) hardware on the guest.",
  "fix_evidence": "fix.diff mirrors the existing graceful path at if_de.c:3114-3122."
}