=== DF-4326 sf_rxeof RX endidx OOB write — guest run ===

sfrh: === DF-4326 sf_rxeof sf_endidx OOB write ===
sfrh[rx]: sf_endidx=2047 -> sf_rx_dlist_big[2047] (SF_RX_DLIST_CNT=256)
sfrh[rx]: desc lands at blk+53232; array spans blk+20480..blk+24576; whole sf_list_data ends at blk+40960 -> 12272 bytes PAST END OF THE CONTIGMALLOC BLOCK
sfrh[rx]: OOB WRITE performed (sf_newbuf semantics):
sfrh[rx]:   desc->sf_mbuf   = 0xabcd11112222
sfrh[rx]:   desc->sf_addrlo = 0x2badb002  sf_valid=1
sfrh[rx]: canary check at blk+40960..blk+57344
sfrh[rx]: canary CLOBBERED at blk+53232 (past-end delta 12272): 0x0b
sfrh[rx]: canary CLOBBERED at blk+53233 (past-end delta 12273): 0xc0
sfrh[rx]: canary CLOBBERED at blk+53234 (past-end delta 12274): 0xb6
sfrh[rx]: canary CLOBBERED at blk+53235 (past-end delta 12275): 0xae
sfrh[rx]: canary CLOBBERED at blk+53240 (past-end delta 12280): 0x22
sfrh[rx]: canary CLOBBERED at blk+53241 (past-end delta 12281): 0x22
sfrh[rx]: canary CLOBBERED at blk+53242 (past-end delta 12282): 0x11
sfrh[rx]: canary CLOBBERED at blk+53243 (past-end delta 12283): 0x11
sfrh[rx]: 12/16384 canary bytes clobbered -> OOB WRITE PAST sf_list_data PROVEN

--- gcc static proof of the RX index OOB ---
  desc = &ld->sf_rx_dlist_big[cur_rx->sf_endidx];
  desc = &ld->sf_rx_dlist_big[cur_rx->sf_endidx];