DF-4235 run.log — live rl(4) session on QEMU rtl8139 (see DF-4236/run.log for
the full churn logs; this file records the RX_ERR-path reachability probe).

attach: rl0@pci0:0:4:0 chip=0x813910ec; miibus0 + rlphy0; link active
functional: ifconfig rl0 10.0.2.16/24 up; route host 10.0.2.3 -iface rl0
  -> nslookup/dig via slirp virtual DNS: ~1250 packets, Ierrs 0, payload
     correctness confirmed by working DNS answers (m_devget copy path +
     ether demux + UDP all correct), incl. 1400-byte EDNS0 frames.
promisc/media/multicast/BPF: exercised, clean.
error-path probe: attempted to drive RL_RXSTAT_RXOK-clear descriptors into
  rl_rxeof() -- NOT POSSIBLE on QEMU's rtl8139: the model delivers every
  accepted frame with ROK set (no CRC/runt error injection; no register
  poke path from userland to force RX status). RESULT: RX_ERR branch
  (if_rl.c:1028-1032) unreachable on this guest -> honest inconclusive
  status; defect stands on source analysis (see VERDICT.md).
no panic, no watchdogs during pure traffic phase; guest stable throughout.