NETWORK_REPORT: map the TCP helpers, socket/queue helpers and utilities

tcp_output (tcp_output.c:46), tcp_template (tcp_subr.c:65), tcp_close
(tcp_subr.c:244), tcp_timers/TCPT_2MSL (tcp_timer.c:144/158) and timeout
(kern_clock.c:232) for the TCP side; ifa_ifwithaddr (if.c:141) for 0x3F61AB30;
in_cksum (in_cksum.c:24, ADDCARRY at :20) for 0x3FB2C290; bcmp (bcmp.c:18) for
0x3F942230; the ntohl macro for 0x3FB2C000. Marked firmware-specific:
0x3F61B000 (lock wrapper), 0x3F61BFC0 (packet accessor), 0x3F60BD40 (queue
post), 0x3FB2C140 (compare helper).

Also: the 120 written at TIME_WAIT is 2 * TCPTV_MSL with PR_SLOWHZ=2
(tcp_timer.h:60, tcp_input.c:1068), so TCB+0x80 is t_timer[TCPT_2MSL].

harness/mame/NETWORK_REPORT.md

@@ -3977,3 +3977,55 @@ Section 56.3's statement is therefore extended: *the protocol stack is 4.4BSD
 lineage with function-for-function counterparts; the driver maps onto the pmax
 `le*` routines; and the deferred I/O structure, the field-codec table and the
 protocol-id dispatcher are the firmware's own, with no source counterpart.*
+
+## 58. TCP helpers, socket/queue helpers and utilities — mapped
+
+### 58.1 TCP helpers
+
+| ROM | 4.4BSD counterpart | quoted evidence |
+|---|---|---|
+| `0x3F645170` "tcp output" | **`tcp_output()` `sys/netinet/tcp_output.c:46`** | `register struct socket *so = tp->t_inpcb->inp_socket;` then the length/window computation — the same field reads (`+0x280`, `+0x120`, `+0x140`, `+0x1E0`, `+0x2A0`) our function performs |
+| `0x3F635910` "alloc/copy" | **`tcp_template()` `sys/netinet/tcp_subr.c:65`** | copies the segment header template into the connection block; the *allocator* (160-byte records from a pool, section 24.6) is the firmware's own |
+| `0x3F64C730` close helper | **`tcp_close()` `sys/netinet/tcp_subr.c:244`** | the teardown called from the CLOSING/LAST_ACK/TIME_WAIT handler `0x3F63F200` (section 30.3) |
+| `0x3F64E960` (timeout branch) | **`tcp_timers()` `sys/netinet/tcp_timer.c:144`, `case TCPT_2MSL:` `:158`** | the timer expiry path |
+| `0x3F6BE2F0` (schedule it) | **`timeout()` `sys/kern/kern_clock.c:232`** | generic kernel timer scheduling |
+
+### 58.2 The 120 in TIME_WAIT is `2 * TCPTV_MSL`
+
+Section 32.2 confirmed on live traffic that entering TIME_WAIT stores **120** at
+TCB `+0x80`. In the source that constant is:
+
+```c
+tcp_timer.h:60   #define TCPTV_MSL ( 30*PR_SLOWHZ)       /* max seg lifetime */
+tcp_input.c:1068 tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
+```
+
+with `PR_SLOWHZ == 2` that is `2 * 60 = 120` — exactly the value measured. So
+TCB `+0x80` is `t_timer[TCPT_2MSL]`, not a generic timeout field.
+
+### 58.3 Socket/interface helper and the queue post
+
+| ROM | counterpart | evidence |
+|---|---|---|
+| `0x3F61AB30` (walks the interface list, compares an address) | **`ifa_ifwithaddr()` `sys/net/if.c:141`** | `for (ifp = ifnet; ifp; ifp = ifp->if_next) for (ifa = ifp->if_addrlist; ...) if (equal(addr, ifa->ifa_addr))` — our function walks `0x96AC0` and compares through `0x3FB2C140` |
+| `0x3F61B000` | **firmware-specific** | a lock wrapper around `0x3F6AC880`; BSD has no equivalent call shape here |
+| `0x3F61BFC0` | **firmware-specific** | packet-field access after the header-pointer computation, no BSD counterpart |
+| `0x3F60BD40` (queue post after enqueue) | **firmware-specific** | BSD calls `ether_input`/`ipintr` directly (section 56.2) |
+
+### 58.4 Utilities
+
+| ROM | counterpart | quoted evidence |
+|---|---|---|
+| `0x3FB2C290` (ones-complement sum) | **`in_cksum()` `sys/netinet/in_cksum.c:24`** | `#define ADDCARRY(x) (x > 65535 ? x -= 65535 : x)` `:20` — the carry folding our `ADDC` loop implements |
+| `0x3F942230` (byte compare with count) | **`bcmp()` `lib/libc/string/bcmp.c:18`** | `bcmp(b1, b2, length)` — our function takes two pointers and a count and compares bytes |
+| `0x3FB2C000` (16/32-bit swap) | **`ntohl()`/`ntohs()` macros**, `sys/pmax/include/endian.h:48` | `#define ntohl(x) (x)` on the big-endian pmax; the firmware implements the swap as a function because its build needs real byte swapping |
+| `0x3FB2C140` (compare helper) | **firmware-specific** | a two-value compare used by `ifa_ifwithaddr`-style scans and by the codec pair; in BSD the equivalent is the inline `equal()` macro (`if.c:147`), not a callable |
+
+### 58.5 Coverage after 58
+
+Every function the report gives an address for now has either a quoted
+counterpart or an explicit firmware-specific entry. The only rows marked
+firmware-specific are the deferred I/O glue (56.2), the field-codec table and
+protocol-id dispatcher (57.1–57.3), the lock wrapper `0x3F61B000`, the packet
+accessor `0x3F61BFC0`, the queue post `0x3F60BD40`, and the compare helper
+`0x3FB2C140`.