# DF-4219 — ae_rx_intr() `for(;;)` walk has no work bound: device-fed AE_RXD_UPDATE livelocks the serializer

`sys/dev/netif/ae/if_ae.c` — pass 2 (GLM 5.3).  DF-3990 (ale) family
instance for ae(4) (alc DF-3761 / jme DF-3778 / age DF-3934 family).

## Build

```
scp -F dfbsd-qemu/config findings/poc/DF-4219/trigger.c dfbsd:/tmp/
vm.sh run_root 'cc -O2 -Wall -Wextra -o /tmp/df4219 /tmp/trigger.c && echo BUILD_4219_OK'
```

Clean build (`-Wall -Wextra`, no warnings), RC=0.

## Run (safe — model self-caps)

```
vm.sh run_root '/tmp/df4219; echo RC_4219=$?'
```

## Expected output

1. Honest device (5 real frames): walk processes exactly 5 descriptors
   and exits via the `:647` guard.
2. Device that keeps `AE_RXD_UPDATE` ahead of the driver's clear: the
   model self-caps after 1,000,000 iterations **in one ae_rx_intr()
   call** (ring wrapped 15,625 times), guard `:647` never went false,
   frame budget consulted by the driver: **0** (none exists — unlike
   ale(4), ae(4) does not even define dead ALE_PROC_*-style knobs).

Success criterion: `RC_4219=0` with the `[2]` self-cap block printed.

## Why only a model

The walk's exit depends on controller-written descriptor flags; the
audit guest has no Attansic L2 NIC (no 1969:xxxx PCI device, `if_ae`
not in X86_64_GENERIC) — hardware-gated per family convention
(DF-3934/DF-3990/DF-3991).  The unboundedness is a structural property
of the loop (only exit = a non-UPDATE descriptor; no budget anywhere in
the driver), demonstrated by the model and by inspection.