There are 2 buffers involved for Rx process. One for the DMA(bufsz)
and another(rx_mbuf_sz) for sending that packet to netstack.
In if_ixv driver, bufsz is set to 4096 if MTU is more than the default
MTU: 1500. Whereas rx_mbuf_sz is set to 2048, for upto MTU 2030
(Calculation is based on frame size: 18). Because of this, for MTU upto
1500, both rx_mbuf_sz & bufsz is 2048. And for MTU above 2031, both
rx_mbuf_sz & bufsz is 4096. Whereas for MTU 1501 to 2030, rx_mbuf_sz
will be 2048 and bufsz is 4096.
So for MTU between 1501 and 2030, if the peer box have bigger MTU and
sends a bigger packet, there is a mismatch between what's written to
the Rx buffers and what's sent to netstack. And when that memory beyond
allocated 2048 is accessed, kernel crashes.
Ideally, bufsz should be based on rx_mbuf_sz (This is calculated right
before configuring Rx settings).
Problem is reproduced locally very consistently and with the fix to
match bufsz & rx_mbuf_sz, it is verified that no crash occurred.
Also, compiler forced me to add a #ifdef around ifp definition.