df4266: dispatching REAL kernel handlers (built-in 'device wb'): wb_rxeof=0xffffffff808dae30 wb_init=0xffffffff808da6d0 wb_stop=0xffffffff808d9850
df4266: layout: sizeof(wb_softc)=0x1e80 if_timer=0x6a bhandle=0x3c0 btag=0x3c8 ldata=0x400 rx_chain0=0x448 stat_timer=0x1e68 snd.altq_subq=0x210
df4266: === Phase 0: fabricate post-attach softc; dispatch REAL wb_init (its inlined wb_list_rx_init arms the ring) ===
dfwb0: reset never completed!
df4266: [P0-after-REAL-wb_init] head==chain0:1 slot0.status=0x80000300 OWN:1 RXLEN:0 mbuf=0xfffff801177dce00 wb_data=0x35ef3108
df4266: P0: ring armed by the kernel's own code: 64 mbufs, descriptors WB_RXSTAT=0x80000300 (FIRSTFRAG|LASTFRAG|OWN M-bM^@M^T chip-owned)
df4266: P0: NOTE (known finding DF-4267): wb_rx_chain[0].wb_nextdesc == &wb_rx_chain[0]: 1 M-bM^@M^T production collapsed-ring state, kept as-is
df4266: === S1: chip COMPLETED a frame in slot 0 (write-back: OWN=0, RXCMP|LASTFRAG|FIRSTFRAG set, len 64) ===
df4266: [S1-crafted] head==chain0:1 slot0.status=0x40400300 OWN:0 RXLEN:64 mbuf=0xfffff801177dce00 wb_data=0x35ef3108
df4266: [S1-after-REAL-wb_rxeof] head==chain0:1 slot0.status=0x40400300 OWN:0 RXLEN:64 mbuf=0xfffff801177dce00 wb_data=0x35ef3108
df4266: S1: delivered=0 ipackets=0 ierrors=0 slot0 re-armed:no head advanced:no
df4266: *** S1 BUG CONFIRMED: the REAL wb_rxeof broke immediately on the chip-COMPLETED descriptor (OWN=0, if_wb.c:974-975): frame DROPPED, descriptor never recycled, ipackets permanently 0 M-bM^@M^T RX dead ***
df4266: === S1fix: IDENTICAL state, one-line-FIXED comparator (verbatim wb_rxeof; loop condition per fix.diff) ===
df4266: if_input: m=0xfffff801177c5000 m_len=60 dst=ff:ff:ff:ff:ff:ff src=00:df:42:66:00:01 type=df42 pay=0e 0f 10 11
df4266: [S1fix-after-fixed-comparator] head==chain0:1 slot0.status=0x80000300 OWN:1 RXLEN:0 mbuf=0xfffff801177dce00 wb_data=0x35ef3108
df4266: S1fix: delivered=1 ipackets=1 slot0.status=0x80000300 (re-armed to WB_RXSTAT: YES)
df4266: *** S1fix: the SAME descriptor state IS deliverable M-bM^@M^T only the inverted OWN test at if_wb.c:974 blocks the production handler ***
df4266: === S2: armed idle ring (all OWN=1, exactly what wb_init leaves) M-bM^@M^T per-dispatch cost of the inverted loop ===
dfwb0: reset never completed!
df4266: [S2-armed] head==chain0:1 slot0.status=0x80000300 OWN:1 RXLEN:0 mbuf=0xfffff801177c4e00 wb_data=0x35ef3108
dfwb0: receiver babbling: possible chip bug, forcing reset
dfwb0: reset never completed!
dfwb0: reset never completed!
df4266: S2: dispatch 0: ipackets=0 ierrors=1 delivered=0 mbuf0 0xfffff801177c4e00->0xfffff801177dce00 (ring re-inited: YES) elapsed=60905 us
dfwb0: receiver babbling: possible chip bug, forcing reset
dfwb0: reset never completed!
dfwb0: reset never completed!
df4266: S2: dispatch 1: ipackets=0 ierrors=2 delivered=0 mbuf0 0xfffff801177dce00->0xfffff801177c4e00 (ring re-inited: YES) elapsed=69831 us
dfwb0: receiver babbling: possible chip bug, forcing reset
dfwb0: reset never completed!
dfwb0: reset never completed!
df4266: S2: dispatch 2: ipackets=0 ierrors=3 delivered=0 mbuf0 0xfffff801177c4e00->0xfffff801177dce00 (ring re-inited: YES) elapsed=65278 us
df4266: *** S2 BUG CONFIRMED: every dispatch PROCESSED a chip-OWNED descriptor: head popped, ierrors++, 'receiver babbling', wb_fixmedia+wb_reset+wb_init = full 64-mbuf ring teardown/re-init PER INTERRUPT-equivalent (production: wb_intr:1137-1147 pays this for every arriving frame) while zero frames are delivered ***
df4266: === S3: descriptor STILL chip-owned (OWN=1) but looking complete M-bM^@M^T the mid-write-back transient the inverted loop wrongly accepts ===
dfwb0: reset never completed!
df4266: [S3-crafted] head==chain0:1 slot0.status=0xc0400300 OWN:1 RXLEN:64 mbuf=0xfffff801177c4e00 wb_data=0x35ef3108
df4266: if_input: m=0xfffff801177c5000 m_len=60 dst=ff:ff:ff:ff:ff:ff src=00:df:42:66:00:01 type=df42 pay=0e 0f 10 11
dfwb0: receiver babbling: possible chip bug, forcing reset
dfwb0: reset never completed!
dfwb0: reset never completed!
df4266: [S3-after-REAL-wb_rxeof] head==chain0:1 slot0.status=0x80000300 OWN:1 RXLEN:0 mbuf=0xfffff801177dce00 wb_data=0x35ef3108
df4266: S3: delivered=1 ipackets=1 ierrors=1 slot0.status=0x80000300 (crafted 0xc0400300; re-armed under the chip: YES)
df4266: *** S3 BUG CONFIRMED: frame ACCEPTED from a descriptor with OWN=1 (chip still owns it) and the descriptor RE-ARMED (status rewritten to WB_RXSTAT) under the chip M-bM^@M^T driver and hardware now disagree about who owns descriptor 0 and its mbuf ***
df4266: SURVIVED M-bM^@M^T see markers above; guest stays up