{
  "finding_id": "DF-3761",
  "file": "sys/dev/netif/alc/if_alc.c",
  "verdict": "inconclusive",
  "impact_class": "none",
  "reproduce": {
    "build": "(nothing to build - trigger is a remote line-rate flood; see trigger.c)",
    "run": "vm.sh run_root 'ifconfig -l; pciconf -l | grep -i -E \"atheros|1969\"; sysctl hw.alc; grep -n alc_process_limit /usr/src/sys/dev/netif/alc/if_alc.c'",
    "expected": "Source-level certain: alc_rxintr (sys/dev/netif/alc/if_alc.c:3222-3289) walks the Rx return ring in an unbounded loop (:3236) while the existing process_limit knob (if_alc.c:1696-1713, ALC_PROC_DEFAULT 64) is never read anywhere in the driver - a dead knob (guest grep shows references only at :1697-1711). Under a sustained line-rate flood the per-frame m_getcl+dmamap_load+if_input cost exceeds arrival rate, the ring stays perpetually non-empty, the loop never terminates: alc_intr has the NIC interrupt disabled for the whole walk (:3082 re-enabled only at :3110) and the walk holds the interface serializer -> one CPU pinned at 100%, all other driver entry points block, callouts starve on that CPU. FreeBSD bounds the identical loop (alc_rxintr(sc, count), 'if (count-- <= 0) break;'); DFly msk(4) likewise (if_msk.c:3225). Runtime honestly inconclusive: the audit guest has no Atheros PCI device (NO_ATHEROS_PCI, ifconfig=vtnet0 lo0, no hw.alc sysctl)."
  },
  "kernel_refs": [
    "sys/dev/netif/alc/if_alc.c:3236",
    "sys/dev/netif/alc/if_alc.c:3239",
    "sys/dev/netif/alc/if_alc.c:3248",
    "sys/dev/netif/alc/if_alc.c:3332",
    "sys/dev/netif/alc/if_alc.c:3187",
    "sys/dev/netif/alc/if_alc.c:1696",
    "sys/dev/netif/alc/if_alc.c:3082",
    "sys/dev/netif/alc/if_alc.c:3110",
    "sys/dev/netif/alc/if_alc.c:3075",
    "sys/dev/netif/alc/if_alcvar.h:71",
    "sys/dev/netif/msk/if_msk.c:3225"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "trigger.c",
    "build.sh",
    "run.sh",
    "run.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}