dfwb3: === DF-4267: ring built by the REAL wb_init (inlined wb_list_rx_init, if_wb.c:894-917) ===
dfwb3: hardware links ld->wb_rx_list[i].wb_next (a closed ring would link i -> i+1, 63 -> 0):
  wb_rx_list[ 0].wb_next = 0x2d471100 <- desc 0
  wb_rx_list[ 8].wb_next = 0x2d471100 <- desc 0
  wb_rx_list[16].wb_next = 0x2d471100 <- desc 0
  wb_rx_list[24].wb_next = 0x2d471100 <- desc 0
  wb_rx_list[32].wb_next = 0x2d471100 <- desc 0
  wb_rx_list[40].wb_next = 0x2d471100 <- desc 0
  wb_rx_list[48].wb_next = 0x2d471100 <- desc 0
  wb_rx_list[56].wb_next = 0x2d471100 <- desc 0
  => 64/64 hardware wb_next words point at descriptor 0 (vtophys(&wb_rx_list[0])=0x2d471100)
dfwb3: software walk from wb_rx_head: distinct descriptors reachable = 2 / 64 (returned to a visited descriptor after 1 hops)
dfwb3: TX contrast: distinct descriptors reachable from wb_tx_free = 129 / 128 (the :878 twin is correct)
dfwb3: [4267-crafted] head==chain0:1 slot0.status=0x40400300 OWN:0 RXLEN:64 mbuf=0xfffff801187e3a00
dfwb3: if_input: m=0xfffff801187eba00 m_len=60 pkthdr.len=60 dst=ff:ff:ff:ff:ff:ff type=df67
dfwb3: after processing the completed frame: delivered=1 head==chain0:1 head==chain1:0 M-bM^@M^T a correct ring advances head to chain[1]
dfwb3: *** DF-4267 CONFIRMED (behavioural): the ring re-enters descriptor 0 M-bM^@M^T the driver can never advance past slot 0; 63/64 pre-armed RX buffers unreachable ***
dfwb3: if_input: m=0xfffff801187eba00 m_len=60 pkthdr.len=60 dst=ff:ff:ff:ff:ff:ff type=df67
dfwb3: A/B with ONE-TOKEN-FIXED links (simulated fix.diff): delivered=1 head==chain1:1 M-bM^@M^T the identical state now advances past slot 0
dfwb3: *** DF-4267 A/B: only the link words differ M-bM^@M^T the collapse is the ternary at if_wb.c:909 ***
dfwb3: MMIO WB_RXADDR=0x2d471100 (== vtophys(&wb_rx_list[0]): YES) M-bM^@M^T every RX (re)start fetches descriptor 0; with all wb_next words pointing back to 0 the chip suspends after ONE frame (per-frame RX restart, wb_intr:1137/wb_rxeoc:1030)
dfwb3: go4267 SURVIVED M-bM^@M^T guest stays up
dfwb3: layout: sizeof(wb_softc)=0x1e80 if_timer=0x6a bhandle=0x3c0 btag=0x3c8 ldata=0x400 rx_chain0=0x448 stat_timer=0x1e68 snd.altq_subq=0x210
dfwb3: resolved: rxeof=0xffffffff808dae30 init=0xffffffff808da6d0 stop=0xffffffff808d9850 start=0xffffffff808d9e90 txeof=0xffffffff808da490 watchdog=0xffffffff808dadc0 mbstat=0xffffffff8131dec0 mbtypes=0xffffffff81325ec0
dfwb3: mbstat stride sanity: sizeof(struct mbstat)=0x80 cachealign-stride=0x80 m_msize0=512 m_msize1=512
dfwb3: === DF-4267: ring built by the REAL wb_init (inlined wb_list_rx_init, if_wb.c:894-917) ===
dfwb3: hardware links ld->wb_rx_list[i].wb_next (a closed ring would link i -> i+1, 63 -> 0):
dfwb3:   wb_rx_list[ 0].wb_next = 0x2ec4b100 <- desc 0
dfwb3:   wb_rx_list[ 8].wb_next = 0x2ec4b100 <- desc 0
dfwb3:   wb_rx_list[16].wb_next = 0x2ec4b100 <- desc 0
dfwb3:   wb_rx_list[24].wb_next = 0x2ec4b100 <- desc 0
dfwb3:   wb_rx_list[32].wb_next = 0x2ec4b100 <- desc 0
dfwb3:   wb_rx_list[40].wb_next = 0x2ec4b100 <- desc 0
dfwb3:   wb_rx_list[48].wb_next = 0x2ec4b100 <- desc 0
dfwb3:   wb_rx_list[56].wb_next = 0x2ec4b100 <- desc 0
dfwb3:   => 64/64 hardware wb_next words point at descriptor 0 (vtophys(&wb_rx_list[0])=0x2ec4b100)
dfwb3: software walk from wb_rx_head: distinct descriptors reachable = 1 / 64 (returned to a visited descriptor after 1 hops)
dfwb3: TX contrast: distinct descriptors reachable from wb_tx_free = 128 / 128 (the :878 twin is correct)
dfwb3: [4267-crafted] head==chain0:1 slot0.status=0x40400300 OWN:0 RXLEN:64 mbuf=0xfffff80118926c00
dfwb3: if_input: m=0xfffff801187fbe00 m_len=60 pkthdr.len=60 dst=ff:ff:ff:ff:ff:ff type=df67
dfwb3: after processing the completed frame: delivered=1 head==chain0:1 head==chain1:0 M-bM^@M^T a correct ring advances head to chain[1]
dfwb3: *** DF-4267 CONFIRMED (behavioural): the ring re-enters descriptor 0 M-bM^@M^T the driver can never advance past slot 0; 63/64 pre-armed RX buffers unreachable ***
dfwb3: if_input: m=0xfffff801187fbe00 m_len=60 pkthdr.len=60 dst=ff:ff:ff:ff:ff:ff type=df67
dfwb3: A/B with ONE-TOKEN-FIXED links (simulated fix.diff): delivered=1 head==chain1:1 M-bM^@M^T the identical state now advances past slot 0
dfwb3: *** DF-4267 A/B: only the link words differ M-bM^@M^T the collapse is the ternary at if_wb.c:909 ***
dfwb3: MMIO WB_RXADDR=0x2ec4b100 (== vtophys(&wb_rx_list[0]): YES) M-bM^@M^T every RX (re)start fetches descriptor 0; with all wb_next words pointing back to 0 the chip suspends after ONE frame (per-frame RX restart, wb_intr:1137/wb_rxeoc:1030)
dfwb3: go4267 SURVIVED M-bM^@M^T guest stays up