sfrh:   rx_dlist_big 4096 bytes @ +20480 (SF_RX_DLIST_CNT=256)
sfrh:   total sizeof(struct sf_list_data)=40960
sfrh: === DF-4325 sf_txeof sf_index OOB (REAL m_freem) ===
sfrh[tx]: sf_index=0x7ff8 -> desc idx=255 (SF_TX_DLIST_CNT=128) idx*128=32640 ring_bytes=16384 -> OUT OF BOUNDS BY 16256 bytes
sfrh[tx]: OOB READ at blk+32640 (inside the sf_rx_clist region: corrupts RX completion reads too): cur_tx->sf_mbuf = 0xdeadc0de0000
sfrh[tx]: sc->sf_tx_cnt 0 -> -1 (UNDERFLOW)
sfrh[tx]: OOB WRITE blk+32640 <- NULL (sf_mbuf field of phantom descriptor)
sfrh[tx]: verify: blk+32640 now reads 0
sfrh[tx]: mode 2: calling REAL m_freem(0xdeadc0de0000) exactly as if_sf.c:1010 would -> EXPECT PAGE FAULT PANIC


Fatal trap 9: general protection fault while in kernel mode
cpuid = 1; lapic id = 1
instruction pointer	= 0x8:0xffffffff806bdcb0
stack pointer	        = 0x10:0xfffff801182bd6e8
frame pointer	        = 0x10:0xfffff801182bd6f8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1096
current thread          = pri 6 
kernel: type 9 trap, code=0

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      m_free+0x10:    movswq  0x20(%rdi),%rax
db>