{
  "finding_id": "DF-4267",
  "status": "reproduced",
  "verdict": "Reproduced on production code: dispatched the running kernels own wb_init() (its inlined wb_list_rx_init is the defective code, if_wb.c:909-911) from the DF-4266 KLD rig; the production post-init ring shows ALL 64 hardware wb_next words == vtophys(&wb_rx_list[0]) and a software wb_nextdesc walk reaching 1/64 distinct descriptors (TX twin at :878: 128/128, confirming the one-token port typo). Behaviourally, a chip-completed frame processed in slot 0 leaves wb_rx_head AT slot 0 \u2014 the driver can never advance past descriptor 0, the chip suspends RX after every frame (per-frame receive-engine restart via wb_intr:1137/wb_rxeoc:1030, RXADDR always &list[0]), and 63/64 pre-armed RX buffers are permanently unreachable: deterministic RX-throughput collapse/DoS on W89C840F-equipped hosts. Fix validated on a rebuilt kernel (kernel #1, fix_validated.diff): wb_next links become i+1 with 63->0, software walk 64/64, head advances to chain[1] \u2014 every defect marker gone.",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "run.kld.dmesg.log (=> 64/64 hardware wb_next words point at descriptor 0, distinct descriptors reachable = 1 / 64, TX contrast ... 128 / 128, *** DF-4267 CONFIRMED (behavioural) *** ... head==chain1:0, A/B with repaired links head==chain1:1); run.kld_fixed.log (fixed kernel: monotonic wb_next links, 64 / 64, head==chain1:1); VERDICT.md table",
  "kernel_refs": [
    "sys/dev/netif/wb/if_wb.c:909",
    "sys/dev/netif/wb/if_wb.c:910",
    "sys/dev/netif/wb/if_wb.c:911",
    "sys/dev/netif/wb/if_wb.c:878",
    "sys/dev/netif/wb/if_wb.c:914",
    "sys/dev/netif/wb/if_wb.c:1030",
    "sys/dev/netif/wb/if_wb.c:1036",
    "sys/dev/netif/wb/if_wb.c:1137",
    "sys/dev/netif/wb/if_wb.c:1467",
    "sys/dev/netif/wb/if_wbreg.h:272"
  ],
  "poc_changes": "Replaced the seeds pure-logic harness verdict (kernel-level reproduction impossible) with the DF-4266 production-handler KLD dispatch rig: the REAL wb_init() builds the ring over a fabricated post-attach softc; added the fixed-OWN comparator (isolates ring topology from DF-4266s inverted loop), the distinct-descriptor walks, the TX-contrast walk, the one-token A/B link repair, and the RXADDR MMIO check. Fix validation added (combined 3-fix kernel).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64 (baseline); #1: Wed Oct 14 22:35:12 UTC 2026 (fix validation)",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cd /root/dfwb3 && make -m /usr/src/share/mk (KLD rig; kernel for fix validation: cd /usr/src && make -j6 nativekernel && make installkernel)",
  "run_cmd": "sh /root/dfwb3/kld_run.sh 4267   [fixed kernel: same command]",
  "code_hash": "7e63578586f10529a7038445604b887f9147dc6ffc90b61d38c334b13fb25194",
  "notes": "Deterministic; no race involved. Rig identical to DF-4268/DF-4270 packs (shared dfwb3_rig.ko, scenario go4267). Baseline runs also re-executed after each guest reset with identical results (2 boots). The claimed impact ceiling is availability (ring depth 1, interrupt storm); no memory corruption demonstrated or claimed.",
  "recommended_fix": "nexti = (i == WB_RX_LIST_CNT - 1) ? 0 : i + 1;  (mirror the TX-side ternary at if_wb.c:878) \u2014 validated as fix_validated.diff hunk 1",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fixed: on the patched kernel the REAL wb_init builds a true closed ring (64/64 reachable, i+1 links, head advances past slot 0); all baseline defect markers gone",
  "fix_evidence": "run.kld_fixed.log; fix_validated.diff; VERDICT.md Fix validation table"
}