# DF-3782 VERDICT — INCONCLUSIVE on this guest — impact (analysis): dos / RX livelock

## Analysis (source-certain)
- The walk `for (;;)` at if_vmx.c:2201 has exactly two exits: a generation
  mismatch on the *next* completion descriptor (i.e. the guest caught up
  with everything the host deposited) or losing IFF_RUNNING mid-walk
  (if_vmx.c:2311-2312, only checked at packet boundaries).
- Per iteration the guest pays `vmxnet3_newbuf()` (m_getjcl + bus_dmamap
  load) and a full `(*ifp->if_input)()` with the RXQ lock dropped/re-taken
  (if_vmx.c:2257, 2169-2171) — strictly more work than the host spends to
  deposit a completion (a DMA write + doorbell).
- Interrupt re-enable happens only after the walk returns:
  `vmxnet3_legacy_intr()` if_vmx.c:2361 / `vmxnet3_rxq_intr()` if_vmx.c:2401.
  So while the ring stays non-empty, the interrupt thread never yields the
  CPU to anything at lower priority, and `vxrxq_lock` is held across the
  whole walk except inside if_input.
- Consequence under a remote line-rate small-packet flood (delivered by the
  host backend): interrupt-thread livelock / softnet livelock; queue stops,
  watchdog cannot run (it needs the core lock path via vmxnet3_tick, which
  still functions, but the rxq never drains). Identical shape to DF-3761
  (alc) and DF-3778 (jme), both already established on this project.

## Why not exercised here
Requires a vmxnet3 paravirtual NIC served by a host that can sustain
completion production; the audit guest is KVM/QEMU with virtio only. A
replica module could demonstrate an *unbounded loop* trivially, but that
would prove nothing beyond the visible `for(;;)` — the security claim is
about host/guest production-vs-drain rates, which needs the real device.
Honest status: **inconclusive**, analysis confidence high, family precedent
(DF-3761/DF-3778) reproduced on this very guest.

## Fix
Budget bound + deferred continuation (fix.diff, advisory). Note the
subtlety: simply breaking early can strand already-deposited completions if
the device does not re-raise the RX interrupt for them, so the fix must
re-arm (short callout / netisr deferral), not just cap the loop.

## Kernel refs
sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2201-2328 (walk),
2352-2361 (legacy intr: lock, eof, then re-enable), 2397-2401 (rxq intr),
2169-2171 (lock drop around if_input), 2257 (newbuf cost per iteration).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.