# DF-3934 — age: RX walk has no work bound (AGE_PROC_* dead) and 16-bit producer indices are not masked to ring sizes

## Build / Run (on hardware)
- Line-rate RX flood to an age(4) interface keeps `cmb->rprod_cons` advancing
  while age_rxintr drains: with no `prog` bound the interrupt handler loops
  under `ifp->if_serializer` indefinitely (CPU + NIC livelock; ticks/watchdog
  starve).
- Malicious/buggy NIC variant: reporting rr_prod >= 512 (or tpd_cons >= 256,
  values that mod-512/mod-256 consumers can never equal) makes the loop
  condition unachievable; only the nsegs==0 / length-mismatch breaks end it,
  and a hostile ring defeats those too.

## Expected result
Interrupt-context livelock holding the serializer: interface and CPU wedge
(no panic).  The TX side analog (tpd_cons unreachable) drains ALL in-flight
descriptors bounded only by tx_cnt — reclaiming mbufs/DMA maps for
descriptors the NIC may still own.

Hardware-gated (no L1 NIC in the audit guest); family precedent DF-3761
(alc) used the identical classification.  See VERDICT.md.