{"finding_id":"DF-4775","status":"untested","attempts":0,"reproduced":0,"impact":"dos","confidence":"certain","verdict":"Source-certain dead-code twin of DF-4745 (verified identical structure by direct read): am7990_start_locked falls through to ifq_dequeue+lance_put after detecting a chip-owned TMD (missing upstream break, am7990.c:503-508). am7990_config has ZERO in-tree callers (if_lnc_pci.c:431 wires only am79900_config) - compiled into if_lnc.ko but unreachable on every current DFly platform; would need a future bus front-end. No LANCE hardware in QEMU. One-line break fix (fixes both twins in one sweep).","exploit_chain":"n/a on this tree (dead code); if revived: TX-ring desync -> driver overwrites chip-owned descriptor/buffer -> mangled frames + BUFF-error watchdog loop (interface hang)","evidence":"findings/poc/DF-4775/ (this verdict)","kernel_refs":["sys/dev/netif/lnc/am7990.c:503","sys/dev/netif/lnc/am7990.c:510","sys/dev/netif/lnc/am7990.c:523"],"guest_uname":"","code_hash":""}