VERDICT — DF-4267 (RX ring collapse in wb_list_rx_init, if_wb.c:909)

Status: reproduced (deterministic, production code) — fix validated: fixed.

Method

Same evidence class as the accepted DF-4266 verification: the guest has no W89C840F NIC, but device wb is built into X86_64_GENERIC, so the driver's real static functions live in the running kernel. The rig (dfwb3_rig.c, built -Werror clean; struct-layout cross-checked against the kernel's own disassembly — see DF-4266's pack) resolves wb_init from /boot/kernel/kernel via nm(1), fabricates the proven post-attach softc, and dispatches the kernel's own wb_init() — its inlined wb_list_rx_init builds the ring exactly as production does at every wb_init call (boot, SIOCSIFFLAGS, every babble reset, watchdog...). The ring that wb_init leaves behind IS the finding's subject.

Baseline — stock kernel #0 (Jul 2 2026), run.kld.dmesg.log

1. Hardware links: all 64 wb_rx_list[i].wb_next == vtophys(&wb_rx_list[0]) (0x2ec4b100 in that boot). A closed ring would link i→i+1 and 63→0. => 64/64 hardware wb_next words point at descriptor 0.
2. Software links: walk from wb_rx_head via wb_nextdesc: distinct descriptors reachable = 1 / 64 (returned to a visited descriptor after 1 hops).
3. TX contrast (:878 twin, correct): 128 / 128.
4. Behaviour: crafted completed frame (OWN=0, RXCMP|FIRST|LAST, len 64) in slot 0, processed by the fixed-OWN comparator (the stock rxeof's inverted loop is DF-4266 and would mask frame processing; the comparator changes ONLY that comparison): frame delivered (delivered=1), then head==chain0:1 head==chain1:0 — the ring re-enters descriptor 0. Repairing only the 64 wb_nextdesc words (simulating the one-token fix): the identical state delivers and advances head==chain1:1 — the collapse is the only difference.
5. Chip view: MMIO WB_RXADDR == vtophys(&wb_rx_list[0]) always; the chip fetches desc 0, completes, follows wb_next back to desc 0, finds it unrecycled and suspends → per-frame RX restart (wb_intr:1137, wb_rxeoc:1030-1039 rewrites RXADDR and pokes RXSTART); with DF-4266's inversion also present, the driver additionally re-arms under the chip.

Impact: deterministic RX-throughput collapse / interrupt churn (availability DoS) on W89C840F/Compex RL100-ATX hosts — the ring is 1-descriptor deep regardless of traffic; 63/64 pre-armed RX buffers (64 MGETHDR mbufs + 256 KB of contigmalloc buffers) are permanently unreachable. Severity: availability bug (High per DB row; no memory corruption — DF-4268 tracks the corruption family and was NOT confirmed, see its pack).

Fix validation — kernel #1 (Oct 14 2026, same tree + fix_validated.diff)

fix_validated.diff (combined DF-4267+DF-4268+DF-4270) applied inside the guest's /usr/src; make -j6 nativekernel + installkernel (build log line 18497 recompiles if_wb.c); rebooted into kernel #1; the identical rig re-run (run.kld_fixed.log):

fix_status: fixed (baseline_reproduced=1, patched_reproduced=0).

Rig artifacts / incidents

None for this scenario (no threads, no races): stock and fixed runs both SURVIVED with the guest clean. The rig bugs recorded in the sibling packs (DF-4268 toggle-thread exit, DF-4270 unguarded txeof dispatch) do not touch the 4267 scenario.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.