# VERDICT — DF-4267 (RX ring collapse in wb_list_rx_init, if_wb.c:909)

**Status: reproduced** (deterministic, production code) — **fix validated:
fixed**.

## Method

Same evidence class as the accepted DF-4266 verification: the guest has no
W89C840F NIC, but `device wb` is built into X86_64_GENERIC, so the driver's
real static functions live in the running kernel. The rig
(`dfwb3_rig.c`, built `-Werror` clean; struct-layout cross-checked against
the kernel's own disassembly — see DF-4266's pack) resolves `wb_init` from
`/boot/kernel/kernel` via `nm(1)`, fabricates the proven post-attach softc,
and **dispatches the kernel's own `wb_init()`** — its inlined
`wb_list_rx_init` builds the ring exactly as production does at every
`wb_init` call (boot, SIOCSIFFLAGS, every babble reset, watchdog...).
The ring that `wb_init` leaves behind IS the finding's subject.

## Baseline — stock kernel #0 (Jul 2 2026), run.kld.dmesg.log

1. **Hardware links**: all 64 `wb_rx_list[i].wb_next` == `vtophys(&wb_rx_list[0])`
   (0x2ec4b100 in that boot). A closed ring would link i→i+1 and 63→0.
   `=> 64/64 hardware wb_next words point at descriptor 0`.
2. **Software links**: walk from `wb_rx_head` via `wb_nextdesc`:
   `distinct descriptors reachable = 1 / 64 (returned to a visited
   descriptor after 1 hops)`.
3. **TX contrast** (`:878` twin, correct): `128 / 128`.
4. **Behaviour**: crafted completed frame (OWN=0, RXCMP|FIRST|LAST, len 64)
   in slot 0, processed by the fixed-OWN comparator (the stock rxeof's
   inverted loop is DF-4266 and would mask frame processing; the comparator
   changes ONLY that comparison): frame delivered (`delivered=1`), then
   `head==chain0:1 head==chain1:0` — **the ring re-enters descriptor 0**.
   Repairing only the 64 `wb_nextdesc` words (simulating the one-token fix):
   the identical state delivers and advances `head==chain1:1` — the
   collapse is the only difference.
5. **Chip view**: `MMIO WB_RXADDR == vtophys(&wb_rx_list[0])` always; the
   chip fetches desc 0, completes, follows `wb_next` back to desc 0, finds
   it unrecycled and suspends → per-frame RX restart (`wb_intr:1137`,
   `wb_rxeoc:1030-1039` rewrites RXADDR and pokes RXSTART); with DF-4266's
   inversion also present, the driver additionally re-arms under the chip.

Impact: deterministic RX-throughput collapse / interrupt churn
(availability DoS) on W89C840F/Compex RL100-ATX hosts — the ring is
1-descriptor deep regardless of traffic; 63/64 pre-armed RX buffers
(64 MGETHDR mbufs + 256 KB of contigmalloc buffers) are permanently
unreachable. Severity: availability bug (High per DB row; no memory
corruption — DF-4268 tracks the corruption family and was NOT confirmed,
see its pack).

## Fix validation — kernel #1 (Oct 14 2026, same tree + fix_validated.diff)

`fix_validated.diff` (combined DF-4267+DF-4268+DF-4270) applied inside the
guest's `/usr/src`; `make -j6 nativekernel` + `installkernel` (build log
line 18497 recompiles if_wb.c); rebooted into kernel #1; the identical rig
re-run (run.kld_fixed.log):

| observable | stock #0 | fixed #1 |
|---|---|---|
| `wb_rx_list[i].wb_next` | all == &list[0] | monotonic i+1 (…b110, …b190, …b210), 63→0 |
| software walk from head | **1 / 64** | **64 / 64** |
| head after processing slot 0 | chain[0] (stuck) | chain[1] (advances) |
| TX contrast | 128/128 | 128/128 (unchanged) |

fix_status: **fixed** (baseline_reproduced=1, patched_reproduced=0).

## Rig artifacts / incidents

None for this scenario (no threads, no races): stock and fixed runs both
SURVIVED with the guest clean. The rig bugs recorded in the sibling packs
(DF-4268 toggle-thread exit, DF-4270 unguarded txeof dispatch) do not touch
the 4267 scenario.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.