{
  "finding_id": "DF-4068",
  "title": "ti_rxeof/ti_txeof/ti_handle_events terminate on raw equality with the NIC-DMA'd 32-bit producer/consumer words: one out-of-range word makes the loop unsatisfiable -> interrupt-context livelock with host interrupts masked and the ifnet serializer held (DF-3761 unbounded-walk family, ti(4) instance)",
  "verdict": "inconclusive",
  "impact": "none_observed_hw_gated__source_permanent_cpu_livelock_dos",
  "reproduce": {
    "build": "cc -O2 -Wall -Wextra -o /tmp/df4068 /tmp/df4068.c",
    "run": "/tmp/df4068 (termination simulator; on real hw: out-of-range DMA'd index word)",
    "expected": "benign walks terminate; poisoned walks (0x8000/0x1000/0x10000/0xffffffff) never terminate in budget (RC_DF4068_MODEL=0); on hardware: hard IRQ livelock"
  },
  "kernel_refs": [
    "sys/dev/netif/ti/if_ti.c:511",
    "sys/dev/netif/ti/if_ti.c:1629",
    "sys/dev/netif/ti/if_ti.c:1729",
    "sys/dev/netif/ti/if_ti.c:1778",
    "sys/dev/netif/ti/if_tireg.h:485"
  ],
  "artifacts": ["README.md", "VERDICT.md", "trigger.c", "build.sh", "run.sh", "build.log", "run.log", "env.txt", "fix.diff", "fix_build.log", "manifest.json", "verdict.json"]
}