{
  "finding_id": "DF-4236",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "likely",
  "verdict": "Reproduced 2/2 on the QEMU-emulated rtl8139: 300 rapid ifconfig rl0 down/up cycles leave rl(4) in a state where TX completions are intermittently never observed -- recurring rl0: watchdog timeout (11 total), Oerrs climbing 0->11, DNS queries needing 4s retransmits, and one ~30s hard TX stall that self-healed only via the watchdog-driven rl_init(). No panic, no corruption, guest stayed up. Every watchdog is proof of frames queued by rl_start (if_rl.c:1375) whose RL_LAST_TXSTAT completion test (if_rl.c:1122-1125) never fired for 5s. Attribution driver-vs-QEMU-model is likely-but-not-pinned: source-side, rl_list_tx_init (:935-949) zeroes RL_TXADDR0-3 but NEVER clears RL_TXSTAT0-3, and rl_init does not rl_reset, so stale completion bits survive every re-init -- exactly the corner where the emulators descriptor state and the driver desync; real silicon may be benign. Low severity: trigger is ifconfig (root), though the identical re-init state machine also runs unprivileged-adjacent via rl_watchdog/rl_intr.",
  "exploit_chain": "root (or any path driving repeated IFF_DOWN/UP, e.g. watchdog cascade) -> churn -> missed TX completions -> 5s watchdog stalls recurring indefinitely -> interface availability degraded until quiescence.",
  "evidence": "run.log (both sessions: counters, dmesg watchdog lines, tcpdump 4s retransmit gaps, /var/log/messages), rl_live_test.sh + rl_repro.sh (exact reproducers), guest_env.txt (attach + final counters), env.txt (emulator/device IDs), dfbsd-qemu/vm_rl.sh (temp launcher)",
  "kernel_refs": [
    "sys/dev/netif/rl/if_rl.c:935",
    "sys/dev/netif/rl/if_rl.c:943",
    "sys/dev/netif/rl/if_rl.c:1122",
    "sys/dev/netif/rl/if_rl.c:1375",
    "sys/dev/netif/rl/if_rl.c:1562",
    "sys/dev/netif/rl/if_rl.c:1570",
    "sys/dev/netif/rl/if_rl.c:1591"
  ],
  "poc_changes": "n/a (first observation; harness authored this run)",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 480,
  "guest_dirty": 0,
  "build_cmd": "n/a (shell-only PoC: sh rl_repro.sh)",
  "run_cmd": "vm.sh down && ./vm_rl.sh && sh /tmp/rl_live_test.sh  (guest root)",
  "code_hash": "2c34b5ec90958ac535de190b0cf9fef4375318ccbd4610f2b5108ee07a4e405e",
  "notes": "Recovery always via rl_watchdog -> rl_init (no rl_reset involved). One controlled repro (rl_repro.sh) showed the route survived and traffic still flowed while watchdogs continued -- the stall is per-descriptor, not interface-wide. Guest restored to the standard virtio launcher after the session.",
  "recommended_fix": "Clear RL_TXSTAT0-3 in rl_list_tx_init() so re-init cannot inherit stale descriptor state (candidate, see fix.diff); validate on real silicon.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Candidate one-line fix authored (fix.diff) but not kernel-rebuild-validated: with root cause not fully pinned to the driver, a patched-guest run cannot distinguish fix works from model artifact; rebuild budget reserved for memory-corruption findings per contract.",
  "fix_evidence": "fix.diff; baseline reproduction in run.log"
}