# DF-3782 — vmxnet3_rxq_eof() RX completion walk has no work bound (DF-3761/3778 family)

## What
`vmxnet3_rxq_eof()` (sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2201-2328) runs

```c
for (;;) {
        rxcd = &rxc->vxcr_u.rxcd[rxc->vxcr_next];
        if (rxcd->gen != rxc->vxcr_gen)
            break;          /* the ONLY exit beside IFF_RUNNING loss */
        ...vmxnet3_newbuf() (mbuf alloc + dmamap load) + if_input()...
}
```

with **no iteration budget**. It is called from the interrupt path
(`vmxnet3_legacy_intr` if_vmx.c:2352-2354; `vmxnet3_rxq_intr` if_vmx.c:2397-2399
on MSI-X platforms) holding the RX queue lock, and the RX interrupt is only
re-enabled *after* the walk returns (if_vmx.c:2361, 2401). While the host
(nominally fed by the physical network) keeps the completion ring populated
faster than the guest drains it — each iteration costs an mbuf cluster
allocation, a DMA map load and a full `if_input()` — the walk never exits:
interrupt-thread livelock holding `vxrxq_lock`, exactly the DF-3761 (alc) /
DF-3778 (jme) family. A remote line-rate small-packet flood through the
host's vmxnet3 backend is the trigger; the whole vCPU services RX forever
and nothing else on that interrupt thread progresses.

vmxnet3 has no `process_limit`-style knob at all (unlike alc/msk), so there
is no operator mitigation.

## Status on this audit guest
The KVM/QEMU guest has **no vmxnet3 device**, so the livelock cannot be
exercised end-to-end here. The mechanism is source-certain (the loop, its
sole exit conditions, the lock, and the interrupt re-enable ordering are all
plain in if_vmx.c), and it is the same mechanism already proven on this
guest for the alc(4)/jme(4) instances of the family (DF-3761/DF-3778).
Verdict: **inconclusive** (device-triggerable, not testable on this guest),
confidence in the analysis: high.

## Suggested fix (fix.diff, advisory)
Bound the walk with a budget; when the budget is exhausted, save the chain
state (as the gen-mismatch exit already does, if_vmx.c:2204-2205) and
re-arm processing via a short callout instead of spinning. Alternatively
defer to a netisr as other DFly drivers do.