--- device presence ---
vtnet0 lo0
NO_STGE_HW
--- geometry model ---
DF-4045 stge_rxeof length-trust geometry model
descriptor DMAFrameLen field    : 16 bits, max 65535
RX cluster (stge_newbuf)       : 2048 bytes (2046 with ETHER_ALIGN)
only bound in driver           : pkthdr.len > framesize (if_stge.c:1625)
framesize default MTU          : 1518
framesize jumbo  MTU 9004      : 9022 (SIOCSIFMTU allows it, if_stge.c:1261)

case A - jumbo MTU, FrameEnd claims framelen = framesize:
  k=0 intermediates: last m_len 9022 - 0 = 9022 on 2048-byte cluster -> OOB read 6974 bytes past cluster
  k=1 intermediates: last m_len 9022 - 2048 = 6974 on 2048-byte cluster -> OOB read 4926 bytes past cluster
  k=2 intermediates: last m_len 9022 - 4096 = 4926 on 2048-byte cluster -> OOB read 2878 bytes past cluster
  k=3 intermediates: last m_len 9022 - 6144 = 2878 on 2048-byte cluster -> OOB read 830 bytes past cluster
  (default MTU: framelen <= 1518 < 2046 -> case A needs jumbo MTU)

case B - any MTU, framelen < rxlen (negative tail m_len):
  k=1 intermediates (rxlen 2046), FrameEnd framelen 100 -> m_len = -1946
  pkthdr.len = 100 <= framesize -> passes if_stge.c:1625; first mbuf full -> survives ether_input guard
  m_copydata: unsigned count = min(-1946 - off, len) -> ~4GB bcopy -> panic (uipc_mbuf.c:1689)

precondition: device-DMA'd RFD status lie (faulty/malicious TC9021); guest has no stge(4) device
RC_4045=0