{
 "finding_id": "DF-4745",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Line-accurate confirmation + real-driver exercise, no desync on emulated hardware. am79900.c:538-544: when the next TMD still has LE_T1_OWN the code sets OACTIVE and prints 'missing buffer' but has NO break - the upstream NetBSD code breaks there (diff-verified; dropped in the 2006 FreeBSD import) - so control falls through to ifq_dequeue+lance_put, consuming the mbuf and overwriting the descriptor/buffer the LANCE still owns. On the guest, the real driver ran against real emulated hardware: QEMU pcnet (1022:2000) attaches lnc0 natively (16 RX/4 TX buffers) and two flood rounds (4 then 8 concurrent ping floods, 1472-byte frames, 29,693 output packets total) produced ZERO 'missing buffer' log lines, 0 oerrors, no watchdog - the QEMU pcnet backend completes TX so fast the chip-owned-TMD precondition never arises under load. The defect is code-certain (verifiable against upstream); impact ceiling on real hardware is a mangled-TX/watchdog interface hang (all writes stay inside the 32K shared DMA region). pcn(4) normally wins the probe on GENERIC; lnc(4) is compiled into the stock kernel (attached here without kldload).",
 "evidence": "run.log (lnc0 attach lines, netstat -I lnc0 counters after floods, zero 'missing buffer'), source excerpt :538-544",
 "kernel_refs": [
  "sys/dev/netif/lnc/am79900.c:539",
  "sys/dev/netif/lnc/am79900.c:541",
  "sys/dev/netif/lnc/am79900.c:544"
 ],
 "poc_changes": "none (driver ran as shipped; QEMU pcnet used as the real device)",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 180,
 "guest_dirty": 0,
 "build_cmd": "",
 "run_cmd": "QEMU_EXTRA='-device pcnet,netdev=n1 -netdev user,id=n1' ./vm.sh up; ifconfig lnc0 192.168.77.1/24 up; 8x ping -f -s 1472 192.168.77.5x",
 "code_hash": null,
 "notes": "hardware-gated manifestation; twin at am7990.c:503. Fix is the one-line upstream break.",
 "recommended_fix": "add the missing 'break;' after the if_printf in both am79900.c:544 and am7990.c:503."
}