# guest: DragonFly dfbsd 6.5-DEVELOPME3990T #0 Thu Jul  2 06:02:54 UTC 2026 x86_64
# build: cc -O2 -Wall -Wextra -o /tmp/tr3990 /tmp/t3990.c   (guest cc 8.3 [DragonFly])
# run:   /tmp/tr3990   (as root via vm.sh run_root)
$ /tmp/tr3990
DF-3990 model: unbounded ale_rxeof walk + unmasked ale_txeof producer

[1] ale_rxeof: loop guard is only (cons < prod); prod is
    device-fed and re-read on page flip. Simulating a device
    that keeps prod == cons+1 for 1,000,000 'delivered' slots:
    iterations completed=1000000, budget used by driver=0 (ALE_PROC_* dead knobs) -> with a real device keeping prod ahead this never ends (serializer held)

[2] ale_txeof: prod=CSR_READ_2(0x1804) unmasked (0..65535), ring=256
    prod=1000 (not congruent in ring) -> cons never equals it; walk bounded ONLY by tx_cnt: freed ALL 40 queued frames' mbufs+dmamaps regardless of real completion -> OVER-RECLAIM (premature m_freem of descriptors the NIC still owns)

TRIGGER_RC=0 (model OK; hardware-gated on this guest: no Atheros NIC)
RC_3990=0