MSI-X allocation failure silently falls back to one MSI/legacy vector while rx_ring_cnt stays >1: RSS rings 1..N are configured but never serviced — traffic blackhole on BCM5709/5716

Summary

bce_setup_ring_cnt() derives rx_ring_cnt (>1 with the extra RSS ring) from the device's MSI-X capability count, before any vector is allocated. If bce_try_alloc_msix() later fails (vector exhaustion under system pressure), bce_alloc_intr() silently falls back to a single MSI/legacy interrupt but the ring count is not recomputed. bce_init() then programs RSS across all rings, and only ring-0 handlers exist: the legacy/MSI path services exclusively rx_rings[0]/tx_rings[0], and bce_check_msi only funnels back into bce_intr. Frames hashed onto rings 1..N land in their status blocks but no interrupt is ever delivered - those flows stall indefinitely (no RX watchdog). Availability bug, environment-dependent; recoverable only via manual ifpoll or reboot. Verification skipped per contract (Low).