# DF-4997 — if_ral_pci.c writes sc_invalid through the rt2560 union alias; for rt2860-family devices the offsets diverge and the write lands on rt2860_softc.sc_debug (sc_invalid stays permanently 0)

## Where

`sys/dev/netif/ral/if_ral_pci.c:205,249-251,296,308` (union `ral_pci_softc`
at :143-155) vs the softc prefixes in `rt2560var.h:106-122`,
`rt2661var.h:99-115`, `rt2860var.h:117-132`.

## What

The glue uses `struct rt2560_softc *sc = &psc->u.sc_rt2560;` as a universal
alias and writes `sc->sc_invalid` (attach: 1 then 0; detach: `!bus_child_present`).
The three child structs documented a *common prefix* ("The same in both up
to here", rt2860var.h:133-135), but rt2860_softc drifted from it:
`sc_snd` was moved before `sc_mtx` and `sc_tx_timer` was dropped from the
prefix (it lives at rt2860var.h:160).  Consequence for the default dispatch
(all rt2860-family PCI IDs, 24+ of 33 entries in `ral_pci_ids`):

- `rt2560_softc.sc_invalid` (offset 7404) == `rt2860_softc.sc_debug` (7404)
  → the glue writes **sc_debug**, not sc_invalid;
- `rt2860_softc.sc_invalid` (7400) is **never set** — the "card ejected"
  guards (`rt2860.c:2080` watchdog; the whole point of the flag) can never
  fire, and the "not-yet-initialized" latch during attach is dead.

rt2661 keeps the rt2560 prefix (both at 7404) and is unaffected;
`sc_st`/`sc_sh` coincide in all three (7360/7368 — the mtx/snd swap is
offset-neutral since both are 8-aligned blocks), so the bustag/handle setup
is correct and impact is confined to sc_invalid/sc_debug.

## Reproduce (build/run on the audit DragonFly guest)

See `../DF-4996/` — the same module prints the compiled offsets at MOD_LOAD
(`df4996.c`, `df4997_report_offsets()`).  Copies of the decisive output are
in `run.log`.

```
kldload ./df4996.ko
dmesg | grep DF4997
```

## Expected output (observed 2026-09-25)

```
DF4997: rt2560_softc size=7920: ... sc_tx_timer=7400 sc_invalid=7404 sc_debug=7408
DF4997: rt2661_softc size=8040: sc_invalid=7404 sc_debug=7408
DF4997: rt2860_softc size=21536: ... sc_invalid=7400 sc_debug=7404 sc_tx_timer=21224
DF4997: VERDICT rt2560.sc_invalid alias == rt2860.sc_debug: glue writes MISS sc_invalid and hit sc_debug on rt2860 (claim TRUE)
DF4997: sc_st/sc_sh offsets DO coincide (...)
```