{
  "finding_id": "DF-3907",
  "title": "xl_rxeof() interrupt-mode Rx walk has no work bound - every intr-path caller passes count=-1 and non-905B chips goto-again restart the walk (DF-3761 family, xl(4) instance)",
  "file": "sys/dev/netif/xl/if_xl.c",
  "impact": "remote RX livelock/DoS on 3c90x hardware (interrupt CPU + serializer pinned indefinitely)",
  "verdict": "inconclusive (source-certain, hardware-gated)",
  "reproduce": {
    "build": "n/a - no 3c90x NIC on the audit guest",
    "run": "n/a - requires 3Com 3c90x hardware + line-rate RX flood",
    "expected": "on real hardware: xl_intr pinned at 100% CPU, serializer held indefinitely, ifpoll/softclock starvation"
  },
  "kernel_refs": [
    "sys/dev/netif/xl/if_xl.c:1960",
    "sys/dev/netif/xl/if_xl.c:2062",
    "sys/dev/netif/xl/if_xl.c:2335",
    "sys/dev/netif/xl/if_xl.c:2339",
    "sys/dev/netif/xl/if_xl.c:2616"
  ],
  "artifacts": [
    "README.md",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}