# guest: DragonFly dfbsd 6.5-DEVELOPME3989T #0 Thu Jul  2 06:02:54 UTC 2026 x86_64
# build: cc -O2 -Wall -Wextra -o /tmp/tr3989 /tmp/t3989.c   (guest cc 8.3 [DragonFly])
# run:   /tmp/tr3989   (as root via vm.sh run_root)
$ /tmp/tr3989

DF-3989 model: ale_rxeof unbounded 14-bit RRS length
  (sys/dev/netif/ale/if_ale.c:2204,2232; if_alereg.h:675)

non-jumbo (AR8113/AR8114) page = roundup(1522+196608,32) = 198144 bytes
  worst-case rs at cons=196576, copy 16379 bytes -> read ends 212963
  => OOB READ past DMA page: 14819 bytes of adjacent kernel heap into mbuf -> if_input (kernleak)
jumbo     (AR8121) page = roundup(8132+196608,32) = 204768 bytes
  worst-case rs at cons=196576, copy 16379 bytes -> read ends 212963
  => OOB READ past DMA page: 8195 bytes of adjacent kernel heap into mbuf -> if_input (kernleak)

length<4 variant: m_devget(int tot <= 0) returns NULL -> iqdrops (SAFE, unlike bce/alc)
legitimate max frame (jumbo): 8132 (mtu 8110 + 18 hdr/vlan + 4 crc) < 16383 mask max -> any length in (8132..16383] is a device lie

TRIGGER_RC=0 (model OK; hardware-gated on this guest: no Atheros NIC)
RC_3989=0