# DF-3778 — jme_rxeof() RX walk has no work bound on the interrupt path: remote line-rate flood keeps the ring perpetually non-empty, handler spins holding the serializer (NIC + CPU livelock)

**File:** `sys/dev/netif/jme/if_jme.c` (pass 2)
**Class:** DF-3761 (alc) family — independent jme(4) instance
**Severity:** Medium · **CWE:** CWE-834 (Uncontrolled Recursion/Consumption) · **Confidence:** certain (source), runtime hardware-gated

## What

`jme_rxeof` (:2488-2562) has exactly one work bound — the `count`
parameter (:2496) — and **every interrupt-context call site passes -1**:
`jme_rx_intr` :3500 (legacy/MSI `jme_intr`), `jme_msix_rx` :3845,
`jme_rx_restart` :3882 (`jme_msix_status`/`jme_npoll_status`).  Only the
ifpoll path bounds it (:3341, `cycle`).  Each iteration is µs-scale
(`jme_newbuf` = `m_getcl` + `bus_dmamap_load_mbuf_segment` :3061-3074,
plus `if_input` dispatch), while a 64-byte flood on 1GbE arrives every
672ns → under sustained small-packet line-rate the ring never drains and
the handler never returns:

* MSI-X RX: the ring's serializer is held for the whole walk (:3837) —
  that CPU spins, all other ring entry points block;
* legacy/MSI: `jme_intr` takes the MAIN serializer (:3912 registration,
  :2118 assert) then walks every ring (:3499) — the whole interface
  wedges behind an unbounded walk, plus the interrupt thread pins its CPU.

No bound knob exists at all in the driver (`process_limit`: 0 hits,
run.log) — the `count` parameter and the ifpoll call site prove the bound
was intended and available.  Sibling precedent: DF-3761 (alc, knob dead),
DFly msk(4) bounds its own walk; FreeBSD bounds these loops.

## Trigger

Remote, unauthenticated, default configuration: flood `jme0` with
minimum-size frames at line rate while the interface is up.

## Reproduce

Hardware-gated on this guest (no JMicron NIC — see run.log presence
probe; `if_jme` is compiled into the running kernel).  Source-level
argument is complete in trigger.c; per family convention (DF-3761) the
verdict is inconclusive with impact none-on-this-guest.

## Fix

`fix.diff` — `hw.jme.rx_proc_limit` (default 64, tunable) passed at the
three interrupt-context call sites; safe because all three handlers mask
their interrupt on entry and re-enable at exit, so a bounded early exit
re-interrupts immediately.  The :418 link-reconfig drain stays unbounded
(interrupts masked, must fully drain).  Compile-validated
(fix_build.log: nativekernel RC=0, 0 warnings).