DF-4231: txp_rx_reclaim() trusts NIC-fed rxd->rx_len
  sink : if_txp.c:676 m->m_len = rxd->rx_len (u_int16, DMA)
  sink : if_txp.c:704 m_copydata(m, 0, m->m_pkthdr.len, mtod(mnew))
  bound: none vs MCLBYTES(2048); overflow up to 63531 bytes past
         the destination cluster, plus equal-size OOB read of the
         source cluster.
  needs: 3c990 Typhoon firmware lying about rx_len (hardware)
DF-4232: txp walks device-fed ring cursors unvalidated
  1) txp_rx_reclaim if_txp.c:658-737  OOB rxd walk / wild rx_sd
     deref / non-terminating while(roff!=woff)
  2) txp_response   if_txp.c:1418-1453 non-terminating walk on
     hv_resp_write_idx; rsp = base + device-fed ridx (OOB read)
  needs: 3Com 3c990 writing hostvar/rx rings (hardware)
DF-4233: txp_init ignores txp_rxring_fill() failure
  if_txp.c:1127 fill rc ignored; :1130 RX_ENABLE anyway
  stale rb_paddrlo => firmware DMA into freed clusters
  unfilled sd->sd_mbuf==NULL => NULL deref at :676
  needs: MCLGET failure + inbound frame on 3c990 hw
===DRIVER_IN_KERNEL===
		161 pci/if_txp
		205 cardbus/if_rl
		206 pci/if_rl
===THREECOM_DEVICE_PROBE===
NO_3COM_PCI_DEVICE
NO_RTL8139_ON_STANDARD_LAUNCHER
===
MD5 (/usr/src/sys/dev/netif/txp/if_txp.c) = 5757b04710b9a2f3b6bbd17196d6df81