{
  "finding_id": "DF-4219",
  "verdict": "Source-certain, runtime hardware-gated (inconclusive per family convention). ae_rx_intr() (if_ae.c:643-668) walks the 64-entry RxD ring in a `for(;;)` whose ONLY exit is a descriptor without the controller-DMA'd AE_RXD_UPDATE bit (:647, if_aereg.h:384); no frame budget exists anywhere in if_ae.c (ale(4) at least defines dead ALE_PROC_* knobs — ae defines none). A faulty/malicious controller (errant DMA, bad silicon, hostile PCIe passthrough NIC — the same device trust model as DF-1452) that re-marks descriptors faster than the driver clears them (:649) keeps ae_intr() inside the loop forever holding ifp->if_serializer (ASSERT_SERIALIZED :754): every iteration m_devget+if_input (:616/:625) and the RX mailbox write (:671) never happens — CPU + softint livelock until reboot. NOT remotely triggerable by packet content alone (a remote flood can only mark descriptors backing real frames; the walk exits on the first unmarked one) — device-paced, same bar as DF-3990 (ale). Walk model built and run on the audit guest (trigger.c, run.log RC=0): honest-device case exits after 5 descriptors; keeps-marking case hits the model self-cap at 1,000,000 iterations in ONE call (ring wrapped 15,625x), budget consulted by driver 0. End-to-end hardware-gated: no 1969:2048 on guest, if_ae not in X86_64_GENERIC, guest src md5 429ba8f801876d3e7a39eca15612f3ed == audited tree. DoS only, no memory corruption, no privilege path.",
  "impact": "none",
  "reproduce": {
    "build": "scp -F dfbsd-qemu/config findings/poc/DF-4219/trigger.c dfbsd:/tmp/ ; vm.sh run_root 'cc -O2 -Wall -Wextra -o /tmp/df4219 /tmp/trigger.c && echo BUILD_4219_OK'",
    "run": "vm.sh run_root '/tmp/df4219; echo RC_4219=$?'",
    "expected": "[1] honest device: 5 descriptors, normal exit; [2] keeps-marking device: MODEL SELF-CAP HIT after 1,000,000 iterations in one ae_rx_intr() call (ring wrapped 15,625x), guard :647 never false, budget consulted 0; RC_4219=0"
  },
  "kernel_refs": [
    "sys/dev/netif/ae/if_ae.c:643",
    "sys/dev/netif/ae/if_ae.c:647",
    "sys/dev/netif/ae/if_ae.c:649",
    "sys/dev/netif/ae/if_ae.c:657",
    "sys/dev/netif/ae/if_ae.c:663",
    "sys/dev/netif/ae/if_ae.c:671",
    "sys/dev/netif/ae/if_ae.c:754",
    "sys/dev/netif/ae/if_ae.c:616",
    "sys/dev/netif/ae/if_aereg.h:384",
    "sys/dev/netif/ae/if_aereg.h:106"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "trigger.c",
    "build.sh",
    "run.sh",
    "run.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}