df4266: dispatching REAL kernel handlers (built-in 'device wb'): wb_rxeof=0xffffffff808dae30 wb_init=0xffffffff808da6d0 wb_stop=0xffffffff808d9850
df4266: layout: sizeof(wb_softc)=0x1e80 if_timer=0x6a bhandle=0x3c0 btag=0x3c8 ldata=0x400 rx_chain0=0x448 stat_timer=0x1e68 snd.altq_subq=0x210
df4266: === Phase 0: fabricate post-attach softc; dispatch REAL wb_init (its inlined wb_list_rx_init arms the ring) ===
dfwb0: reset never completed!
df4266: [P0-after-REAL-wb_init] head==chain0:1 slot0.status=0x80000300 OWN:1 RXLEN:0 mbuf=0xfffff8011713cc00 wb_data=0x36a12108
df4266: P0: ring armed by the kernel's own code: 64 mbufs, descriptors WB_RXSTAT=0x80000300 (FIRSTFRAG|LASTFRAG|OWN M-bM^@M^T chip-owned)
df4266: P0: NOTE (known finding DF-4267): wb_rx_chain[0].wb_nextdesc == &wb_rx_chain[0]: 1 M-bM^@M^T production collapsed-ring state, kept as-is
df4266: === S1: chip COMPLETED a frame in slot 0 (write-back: OWN=0, RXCMP|LASTFRAG|FIRSTFRAG set, len 64) ===
df4266: [S1-crafted] head==chain0:1 slot0.status=0x40400300 OWN:0 RXLEN:64 mbuf=0xfffff8011713cc00 wb_data=0x36a12108
df4266: if_input: m=0xfffff80117124e00 m_len=60 dst=ff:ff:ff:ff:ff:ff src=00:df:42:66:00:01 type=df42 pay=0e 0f 10 11
df4266: [S1-after-REAL-wb_rxeof] head==chain0:1 slot0.status=0x80000300 OWN:1 RXLEN:0 mbuf=0xfffff8011713cc00 wb_data=0x36a12108
df4266: S1: delivered=1 ipackets=1 ierrors=0 slot0 re-armed:YES head advanced:no
df4266: S1: UNEXPECTED outcome M-bM^@M^T inspect markers
df4266: === S1fix: IDENTICAL state, one-line-FIXED comparator (verbatim wb_rxeof; loop condition per fix.diff) ===
df4266: [S1fix-after-fixed-comparator] head==chain0:1 slot0.status=0x80000300 OWN:1 RXLEN:0 mbuf=0xfffff8011713cc00 wb_data=0x36a12108
df4266: S1fix: delivered=0 ipackets=1 slot0.status=0x80000300 (re-armed to WB_RXSTAT: YES)
df4266: S1fix: UNEXPECTED outcome
df4266: === S2: armed idle ring (all OWN=1, exactly what wb_init leaves) M-bM^@M^T per-dispatch cost of the inverted loop ===
dfwb0: reset never completed!
df4266: [S2-armed] head==chain0:1 slot0.status=0x80000300 OWN:1 RXLEN:0 mbuf=0xfffff80117124c00 wb_data=0x36a12108
df4266: S2: dispatch 0: ipackets=0 ierrors=0 delivered=0 mbuf0 0xfffff80117124c00->0xfffff80117124c00 (ring re-inited: no) elapsed=9 us
df4266: S2: dispatch 1: ipackets=0 ierrors=0 delivered=0 mbuf0 0xfffff80117124c00->0xfffff80117124c00 (ring re-inited: no) elapsed=10 us
df4266: S2: dispatch 2: ipackets=0 ierrors=0 delivered=0 mbuf0 0xfffff80117124c00->0xfffff80117124c00 (ring re-inited: no) elapsed=13 us
df4266: *** S2 BUG CONFIRMED: every dispatch PROCESSED a chip-OWNED descriptor: head popped, ierrors++, 'receiver babbling', wb_fixmedia+wb_reset+wb_init = full 64-mbuf ring teardown/re-init PER INTERRUPT-equivalent (production: wb_intr:1137-1147 pays this for every arriving frame) while zero frames are delivered ***
df4266: === S3: descriptor STILL chip-owned (OWN=1) but looking complete M-bM^@M^T the mid-write-back transient the inverted loop wrongly accepts ===
dfwb0: reset never completed!
df4266: [S3-crafted] head==chain0:1 slot0.status=0xc0400300 OWN:1 RXLEN:64 mbuf=0xfffff8011713cc00 wb_data=0x36a12108
df4266: [S3-after-REAL-wb_rxeof] head==chain0:1 slot0.status=0xc0400300 OWN:1 RXLEN:64 mbuf=0xfffff8011713cc00 wb_data=0x36a12108
df4266: S3: delivered=0 ipackets=0 ierrors=0 slot0.status=0xc0400300 (crafted 0xc0400300; re-armed under the chip: no)
df4266: S3: UNEXPECTED outcome
df4266: SURVIVED M-bM^@M^T see markers above; guest stays up