Fix compile-validation session on the audit guest (2026-09-22), full untrimmed
transcript (run via dfbsd-qemu/vm.sh run_root). Exact hunks of fix.diff were applied
to a copy of the pristine file with awk on the guest.

$ cd /tmp/mbxchk && awk '<insert size-clamp before e1000_poll_for_msg; extend write_posted guard>' \
    e1000_mbx.c > e1000_mbx_fixed.c
$ diff -u e1000_mbx.c e1000_mbx_fixed.c
--- e1000_mbx.c	2026-09-22 11:18:21.642228000 +0000
+++ e1000_mbx_fixed.c	2026-09-22 11:18:21.642228000 +0000
@@ -253,6 +253,10 @@
 	if (!mbx->ops.read)
 		goto out;
 
+	/* limit read to size of mailbox */
+	if (size > mbx->size)
+		size = mbx->size;
+
 	ret_val = e1000_poll_for_msg(hw, mbx_id);
 
 	/* if ack received read message, otherwise we timed out */
@@ -280,7 +284,7 @@
 	DEBUGFUNC("e1000_write_posted_mbx");
 
 	/* exit if either we can't write or there isn't a defined timeout */
-	if (!mbx->ops.write || !mbx->timeout)
+	if (!mbx->ops.write || !mbx->timeout || size > mbx->size)
 		goto out;
 
 	/* send msg */

$ cc -fsyntax-only -D_KERNEL -I/usr/obj/usr/src/sys/X86_64_GENERIC \
     -I/usr/src/sys -I/usr/src/sys/dev/netif/ig_hal -I. e1000_mbx_fixed.c 2>cc.err
$ echo "FIXED_CC_RC=$?"    -> FIXED_CC_RC=0
$ cc -fsyntax-only -D_KERNEL -I/usr/obj/usr/src/sys/X86_64_GENERIC \
     -I/usr/src/sys -I/usr/src/sys/dev/netif/ig_hal -I. e1000_mbx.c 2>/dev/null
$ echo "BASE_CC_RC=$?"     -> BASE_CC_RC=0
$ cat cc.err               -> (only systm.h:216 warning: conflicting types for built-in
                              function 'log' [-Wbuiltin-declaration-mismatch], pre-existing)
$ rm -rf /tmp/mbxchk /tmp/fix.diff && echo CLEANED