=== DF-4325 sf_txeof TX completion-index OOB — guest run Sat Sep 19 12:48:02 UTC 2026 ===
uname: 

--- phase A: gcc -Warray-bounds STATIC PROOF (first build attempt) ---
sf_ring_harness.c: In function 'run_tx':
sf_ring_harness.c:123:27: error: array subscript 255 is above array bounds of 'struct sf_tx_bufdesc_type0[128]' [-Werror=array-bounds]
  cur_tx = &ld->sf_tx_dlist[idx];   /* OOB by construction */
            ~~~~~~~~~~~~~~~^~~~~
sf_ring_harness.c:123:27: error: array subscript 255 is above array bounds of 'struct sf_tx_bufdesc_type0[128]' [-Werror=array-bounds]
sf_ring_harness.c: In function 'run_sysctl':
sf_ring_harness.c:195:9: error: array subscript 2047 is above array bounds of 'struct sf_rx_bufdesc_type0[256]' [-Werror=array-bounds]
  desc = &ld->sf_rx_dlist_big[cur_rx->sf_endidx];
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sf_ring_harness.c:195:29: error: array subscript 2047 is above array bounds of 'struct sf_rx_bufdesc_type0[256]' [-Werror=array-bounds]
  desc = &ld->sf_rx_dlist_big[cur_rx->sf_endidx];
          ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~
sf_ring_harness.c:195:29: error: array subscript 2047 is above array bounds of 'struct sf_rx_bufdesc_type0[256]' [-Werror=array-bounds]
sf_ring_harness.c:195:29: error: array subscript 2047 is above array bounds of 'struct sf_rx_bufdesc_type0[256]' [-Werror=array-bounds]
sf_ring_harness.c:195:29: error: array subscript 2047 is above array bounds of 'struct sf_rx_bufdesc_type0[256]' [-Werror=array-bounds]
sf_ring_harness.c:195:29: error: array subscript 2047 is above array bounds of 'struct sf_rx_bufdesc_type0[256]' [-Werror=array-bounds]
sf_ring_harness.c:195:29: error: array subscript 2047 is above array bounds of 'struct sf_rx_bufdesc_type0[256]' [-Werror=array-bounds]
cc1: all warnings being treated as errors
*** Error code 1

--- phase B: mode 1 (OOB read + NULL write + underflow, no wild free) ---

--- phase C: mode 2 (REAL m_freem on OOB-read pointer -> panic) ---
sfrh: === DF-4325 sf_txeof sf_index OOB (REAL m_freem) ===
sfrh[tx]: sf_index=0x7ff8 -> desc idx=255 (SF_TX_DLIST_CNT=128) idx*128=32640 ring_bytes=16384 -> OUT OF BOUNDS BY 16256 bytes
sfrh[tx]: OOB READ at blk+32640 (inside the sf_rx_clist region: corrupts RX completion reads too): cur_tx->sf_mbuf = 0xdeadc0de0000
sfrh[tx]: sc->sf_tx_cnt 0 -> -1 (UNDERFLOW)
sfrh[tx]: OOB WRITE blk+32640 <- NULL (sf_mbuf field of phantom descriptor)
sfrh[tx]: verify: blk+32640 now reads 0
sfrh[tx]: mode 2: calling REAL m_freem(0xdeadc0de0000) exactly as if_sf.c:1010 would -> EXPECT PAGE FAULT PANIC


Fatal trap 9: general protection fault while in kernel mode
cpuid = 1; lapic id = 1
instruction pointer	= 0x8:0xffffffff806bdcb0
stack pointer	        = 0x10:0xfffff801182bd6e8
frame pointer	        = 0x10:0xfffff801182bd6f8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1096
current thread          = pri 6 
kernel: type 9 trap, code=0

CPU1 stopping CPUs: 0x0000003d