# DF-4266 — inverted RX descriptor-ownership test in `wb_rxeof()` (if_wb.c:972-975)

**Verdict: REPRODUCED (kernel-level, production-handler dispatch) — fixed by fix.diff (kernel A/B).**
Impact: unauthenticated adjacent-network RX DoS (100% RX loss + per-interrupt
chip reset/re-init storm) on Winbond W89C840F / Compex RL100-ATX NICs;
ownership-protocol break that races the DMA engine (memory-safety tail
tracked as DF-4268).

## Primary evidence (this revision): production-handler KLD dispatch

The audit guest has no W89C840F NIC, but `device wb` is built into its
X86_64_GENERIC kernel, so the rig dispatches **the running kernel's own
static `wb_rxeof`/`wb_init`/`wb_stop`** (nm-resolved, sysctl-injected)
against a fabricated post-attach softc, with the "chip" simulated by
descriptor write-backs (the driver's only observation point of the NIC).

* Build (in guest):  `sh /root/df4266/kld_build.sh`   → `make -m /usr/src/share/mk`
* Run (baseline):    `sh /root/df4266/kld_run.sh baseline`
* Run (fixed kernel): apply fix.diff to /usr/src, `make -j6 nativekernel
  KERNCONF=X86_64_GENERIC && make installkernel`, reboot, re-run
  `sh /root/df4266/kld_run.sh fixed`
* Expected baseline (stock kernel):
  `S1 BUG CONFIRMED` (chip-completed frame dropped: delivered=0, ipackets=0,
  descriptor untouched) · `S1fix` (identical state delivered by the
  one-line-fixed comparator) · `S2 BUG CONFIRMED` (chip-owned descriptor
  processed per dispatch: ierrors++, "receiver babbling", full 64-mbuf ring
  teardown/re-init, ~65 ms vs 9-13 µs fixed) · `S3 BUG CONFIRMED` (frame
  accepted from OWN=1 descriptor + re-armed under the chip) · SURVIVED.
* Expected fixed kernel: S1 DELIVERED by the real patched handler
  (ipackets=1); S2 dispatches idle-break in µs with zero side effects;
  S3 descriptor untouched; all bug-expectation markers "UNEXPECTED" (= fixed).

## Historical evidence (prior pack revision, kept): logic harness

`wb_logic.c` — deterministic userspace transcription of both loop
conditions, compiled and run on the DragonFly guest itself:
DFLY loop processes 0 completed frames; FreeBSD-4.11-condition processes
exactly the completed one (`logic_run.log`).

## Files

* `df4266_wb_poc.c` / `Makefile` — the KLD dispatch rig (primary PoC)
* `kld_build.sh`, `kld_run.sh` — exact build/run commands
* `kld_build.log` — full clean -Werror module build
* `kld_run_baseline.log` — full dmesg of the baseline run (stock kernel #0)
* `kld_run_fixed.log` — full dmesg of the fixed-kernel run (#1, same rig)
* `fix_build_tail.log` — patched-kernel rebuild evidence (if_wb.c compile + install)
* `panic_rig_v1.txt` — rig v1 NULL-subqueue panic (rig bug, not the finding)
* `env.txt` — kernels, compiler, symbols, source identity (MD5 vs audit tree)
* `VERDICT.md` — full narrative incl. method, layout cross-check, A/B table
* `wb_logic.c`, `run.sh`, `logic_run.log` — prior logic harness (kept)
* `fix.diff` — the one-line fix (restores FreeBSD 4.11 loop direction)
* `manifest.json`, `verdict.json`, `code_hash.txt` (sha256 of df4266_wb_poc.c)