DF-3757 VERDICT — tulip_txput_setup() misses the ri_free == 0 case

Status: not_reproduced (requires live de(4) hardware under TX saturation;

the guard defect is source-proven and logic-model-CONFIRMED)

Root cause

tulip_txput_setup() needs one free TX descriptor to emit the multicast setup frame. Its deferral guard tests only for exactly one free descriptor:

/* sys/dev/netif/de/if_de.c:3631-3636 */
if (ri->ri_free < 2)
    tulip_tx_intr(sc);                                   /* try to reclaim */
if ((sc->tulip_flags & TULIP_DOINGSETUP) || ri->ri_free == 1) {
    sc->tulip_flags |= TULIP_WANTTXSTART;
    return;                                              /* defer */
}
...
ri->ri_free--;                                           /* if_de.c:3644 */
nextout = ri->ri_nextout->di_desc;                       /* if_de.c:3645 */
...
nextout->d_status = TULIP_DSTS_OWNER;                    /* if_de.c:3675 */

== 1 must be < 2. When the TX ring is completely full of chip-owned descriptors — 128/128 in flight, ri_free == 0, and tulip_tx_intr() reclaims nothing because every descriptor still has TULIP_DSTS_OWNER set (if_de.c:3169-3170) — the guard does not defer, and:

1. ri->ri_free-- underflows to -1 (if_de.c:3644) — the ring accounting is now permanently negative; e.g. the free == 0 reclaim at if_de.c:3445 in tulip_txput() is skipped (free starts at -1);
2. the setup frame is programmed over a descriptor the chip currently owns (if_de.c:3645-3675), OR-ing TxSETUPPKT|TxLASTSEG into an in-flight packet descriptor — a descriptor-ownership violation;
3. when the chip later completes that descriptor, tulip_tx_intr() takes the SETUPPKT branch (if_de.c:3176-3196) and never frees the packet's mbuf — the m_freem() only exists in the non-setup branch (if_de.c:3197-3202) → mbuf+cluster leak per occurrence;
4. once the clobbered descriptor is re-used, tulip_txput()'s KASSERT(eop->di_mbuf == NULL, "clobbering earlier tx mbuf") (if_de.c:3544) fires on INVARIANTS kernels → panic; on production kernels the mbuf accounting corruption continues (leak/double-handling).

Trigger path (unprivileged once the NIC exists)

1. Any local user floods traffic through the de(4) interface until the 128-entry TX ring is momentarily 100% chip-owned (saturation; no privilege needed to transmit).
2. The same or another user performs a multicast join: setsockopt(IPPROTO_IP, IP_ADD_MEMBERSHIP, …) → in_addmulti() (sys/netinet/in.c:1393) → if_addmulti() → if_addmulti_serialized() calls ifp->if_ioctl(ifp, SIOCADDMULTI, 0, NULL) with no privilege check on the join itself (sys/net/if.c:2738-2739).
3. tulip_ifioctl (if_de.c:3714-3722) → tulip_addr_filter() sets TULIP_WANTSETUP → tulip_init() (if_de.c:2960-2961) → tulip_txput_setup() with ri_free == 0 → defect.

The same call sequence also arrives from the privileged SIOCADDMULTI / SIOCSIFFLAGS ioctls, but the join path needs no privileges.

Verification narrative

1. Source walk of tulip_txput_setup, tulip_tx_intr, tulip_txput (cited lines) — the == 1 guard and its consequences follow directly; no other guard exists between 3636 and 3644.
2. Guest check (env.txt): de(4) compiled into the kernel but zero DEC 2114x hardware (hw.de.* count 0) → the kernel path cannot execute on this rig at all — a TX ring can never exist.
3. Built and ran the 1:1 logic model on the guest (build.log, run.log): with a 100% chip-owned ring the guard falls through, ri_free becomes -1, and a chip-owned descriptor is reprogrammed — confirmed (exit 0).

Classification: not_reproduced / reproduced=0 / impact=none on this guest. On hardware: unprivileged-triggerable DoS (INVARIANTS panic / mbuf-exhaustion) plus driver-state corruption; timing-window dependent (ring must be 100% in-flight at the join instant), hence AC:H and confidence "likely" rather than "certain" for real-world manifestation.

Recommended fix

if_de.c:3633: change ri->ri_free == 1 to ri->ri_free < 2 (fix.diff). One-line, semantics otherwise unchanged.

Kernel references

• sys/dev/netif/de/if_de.c:3631-3636 (the guard), 3644 (underflow), 3645-3675 (chip-owned descriptor rewrite), 3165-3172 (reclaim semantics), 3176-3202 (SETUPPKT branch skips m_freem), 3445 (free==0 reclaim skipped), 3544 (KASSERT panic)
• sys/net/if.c:2738-2739 (unprivileged SIOCADDMULTI notify into driver)
• sys/netinet/in.c:1393 (IP_ADD_MEMBERSHIP → if_addmulti)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.