# DF-4236 — rl(4): rapid IFF_DOWN/UP churn leaves TX completions permanently missed → recurring watchdog timeouts / multi-second TX stalls (reproduced on emulated rtl8139)

**File:** `sys/dev/netif/rl/if_rl.c`
**Severity:** Low (availability; trigger requires `ifconfig` — i.e. root — but the same state machine also runs from `rl_watchdog()`/`rl_intr()`)
**Status:** reproduced live on the QEMU-emulated rtl8139 (impact=dos, confidence=likely — reproduced 2/2 churn sessions; root-cause attribution between driver and QEMU's device model is not fully pinned, see VERDICT.md)

## Reproduce

```
# host: boot guest with the emulated 8139 (temp launcher, vm.sh untouched):
dfbsd-qemu/vm.sh down && dfbsd-qemu/vm_rl.sh

# guest (root):
ifconfig rl0 10.0.2.16 netmask 255.255.255.0 up
route add -host 10.0.2.3 -iface rl0      # slirp virtual DNS as traffic peer
nslookup -timeout=3 localhost 10.0.2.3   # works (baseline)
j=0; while [ $j -lt 300 ]; do ifconfig rl0 down; ifconfig rl0 up; j=$((j+1)); done
dmesg | tail                              # -> "rl0: watchdog timeout"
nslookup -timeout=3 localhost 10.0.2.3    # stalled/retrying (4 s apart)
netstat -I rl0 -b                         # Oerrs climbing
```

Expected: baseline DNS works; after the churn, `rl0: watchdog timeout`
appears, `Oerrs` climbs (6 → 11 across two sessions here), queries need
multiple 4-second retransmits; one session showed a ~30 s hard TX stall
that self-healed through the watchdog-driven `rl_init()`. No panic, no
memory corruption.

## What it means

`if_timer` is only armed by `rl_start()` when frames are handed to the
chip (`if_rl.c:1375`), so each watchdog is proof that a queued descriptor
never completed. After churn the chip/driver pair intermittently stops
completing TX descriptors; every 5 s `rl_watchdog()` (`if_rl.c:1562-1573`)
does `rl_txeof + rl_rxeof + rl_init` and recovers — at the cost of dropping
everything queued. See VERDICT.md for the attribution analysis (driver-side
`rl_list_tx_init()` leaves stale `TxStatus` completion bits; QEMU's model
vs real 8139 behaviour).