VERDICT — DF-4056 (unbounded rxeof/txeof walks; device indices wider than the SW rings)

Status: reproduced — both halves (production-handler KLD dispatch, DF-4106 vge / DF-4266 wb evidence class) — and fix validated on a rebuilt kernel.

Geometry (headers, confirmed in the running kernel's disassembly)

• ET_RXS_STATRING_INDEX = __BITS(27,16) — 12-bit device field (if_etvar.h:107); the software stat ring is ET_RX_NSTAT = 1024 entries (if_etvar.h:45). Values 1024..4095 can never equal rsr_index.
• ET_TX_DONE_POS_INDEX = __BITS(9,0) — 10-bit device field (if_etreg.h:139); the TX ring is ET_TX_NDESC = 512 (if_etvar.h:42). Values 512..1023 can never equal tbd_start_index.

TX half — KKASSERT panic (panic_tx.txt)

Dispatched the real et_txeof(sc, 0) (the et_start:1223 call shape; symbol t et_txeof) with tbd_used=1 and the MMIO stand-in's ET_TX_DONE_POS = index 600, wrap 0:

panic: assertion "tbd->tbd_used > 0" failed in et_txeof at
/usr/src/sys/dev/netif/et/if_et.c:2050
et_txeof() at et_txeof+0x1cb 0xffffffff804b690b

Exactly as predicted: the loop predicate at :2029 can never be satisfied, the walk decrements tbd_used past zero, the KKASSERT at :2050 fires. Guest died at the ddb prompt.

RX half — livelock under the serializer (run_rx_livelock.log)

Dispatched the real et_intr (inlined et_rxeof) under the rig's serializer with rxs_stat_ring = STATRING index 2000:

• the completion walk (if_et.c:1851) never terminates: ierrors 4,230,460,413 → 4,253,528,605 in ~2 s (~11.5M iterations/s), still growing linearly 9 minutes later (6.6e9+ → +11.7M/s) — the walk sprays rbd_newbuf reallocations, mbuf frees and CSR writes while the interface serializer stays held;
• serializer capture proven: a second thread's lwkt_serialize_enter on the same serializer blocked forever (kern.dfet.grab never returned; zero ACQUIRED lines) — in production every later ioctl/if_start on the interface blocks;
• one CPU pegged, caller unkillable, ps -ax itself hangs, and the guest could not be shut down cleanly afterwards (host force-killed QEMU) — same shutdown wedge as the DF-3715/4025/4046/4051 family.

Rig iteration notes

• The first S1 run (DF-4055 pack) also panicked at m_free — sink adjusted to bound the demonstration; unrelated to this finding.
• S3 launched via a backgrounded sysctl; observation from a second session (stats/grab sysctls); ps replaced by sysctl probes after it proved to hang while the spinner runs.

Fix validation (kernel #1, Oct 14 2026, same tree + fix.diff)

fix.diff validates both device indices against the ring geometry before the walks (rxst_index >= ET_RX_NSTAT → ierrors + return; end >= ET_TX_NDESC → oerrors + return). Identical rig on the rebuilt kernel:

fix_status: fixed (baseline_reproduced=1, patched_reproduced=0).

Impact

One device register/DMA write by a faulty or hostile NIC, then every TX interrupt panics the kernel (stock KKASSERT) or every RX interrupt permanently livelocks a CPU with the interface serializer held. Both observed deterministically. Severity Medium stands (hardware-mediated trigger).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.