From b534bab7d7b20cdef11ead5bcb69b11843edacb4 Mon Sep 17 00:00:00 2001
From: Arti Zirk <arti.zirk@gmail.com>
Date: Fri, 30 Oct 2026 01:31:48 +0200
Subject: [PATCH] NETWORK_REPORT: provenance from 386BSD history, corroborating
 the ICMP case set

The local NetBSD tree reaches back to 1992 with the 386BSD-0.1 import
(a319363d6037). Its sys/netinet/if_ether.c:350 carries the exact ROM string
'arp: ether address is broadcast for IP address', which the modern tree no
longer uses ('link address'), placing the firmware in that lineage.

The 386BSD ip_icmp.c switch contains exactly the case labels that section 46
derived from the ROM's dsj + compare chain (REDIRECT, ECHO, TSTAMP,
TSTAMPREPLY, IREQ, IREQREPLY, MASKREQ, MASKREPLY), confirming that reading
from source rather than inference.
---
 harness/mame/NETWORK_REPORT.md | 64 ++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)

diff --git a/harness/mame/NETWORK_REPORT.md b/harness/mame/NETWORK_REPORT.md
index f7aaf66..01f9557 100644
--- a/harness/mame/NETWORK_REPORT.md
+++ b/harness/mame/NETWORK_REPORT.md
@@ -3511,3 +3511,67 @@ all three implementations agree on.
 identical to the baseline (`0x7B3 / ok=1 / 0x0300 / 0x1C / 0x8300`), as it must
 be, because the model masks the nibble. On the machine it is the first payload
 whose descriptors match what the firmware, Linux and NetBSD all write.
+
+## 51. Provenance: the stack descends from 386BSD — and it corroborates section 46
+
+The local NetBSD tree (`/home/arti/code/NetBSD-src`) carries history back to
+**1992-07-13**, including a `4.4BSD-Lite2` commit and, on 1993-03-21, the
+**initial import of 386BSD-0.1 sources**. That is the right vintage for this
+terminal, and it turns out to be usable as a reference implementation.
+
+### 51.1 An exact string match
+
+The ROM contains `arp: ether address is broadcast for IP address …`
+(section 26.1). In the 386BSD import:
+
+```
+a319363d6037:sys/netinet/if_ether.c:350:
+        "arp: ether address is broadcast for IP address %x!\n",
+```
+
+Modern NetBSD (`sys/netinet/if_arp.c:929`) says *"link address"* instead, so the
+VT1200 matches the **older** wording — the same 386BSD/4.3–4.4 lineage. Other
+messages in the same ROM (`arpresolve: no free entry`) belong to that file too.
+
+### 51.2 The ICMP case set is the 386BSD one
+
+Section 46 concluded from the `dsj` + compare chain that the constants
+5, 8, 13, 14, 15, 16, 17, 18 are ICMP types. The 386BSD `ip_icmp.c` switch
+(`a319363d6037:sys/netinet/ip_icmp.c`) contains exactly these case labels:
+
+```
+case ICMP_REDIRECT:     /* 5  */
+case ICMP_ECHO:         /* 8  */
+case ICMP_TSTAMP:       /* 13 */
+case ICMP_TSTAMPREPLY:  /* 14 */
+case ICMP_IREQ:         /* 15 */
+case ICMP_IREQREPLY:    /* 16 */
+case ICMP_MASKREQ:      /* 17 */
+case ICMP_MASKREPLY:    /* 18 */
+```
+
+(plus the error types `UNREACH`(3), `SOURCEQUENCH`(4), `TIMXCEED`(11),
+`PARAMPROB`(12) and `ECHOREPLY`(0), which our chain does not test). That is
+independent confirmation of the section 46 reading from the reference source,
+not from the ROM alone.
+
+### 51.3 LANCE driver history in the same tree
+
+| path | first added |
+|---|---|
+| `sys/arch/i386/isa/if_le.c` | 1994-07-01 |
+| `sys/dev/isa/if_le.c` | 1994-07-01 |
+| `sys/dev/ic/am7990.c` | 1995-06-28 |
+| `sys/dev/ic/lance.c` | 1998-07-21 |
+
+The 1994 ISA driver is the closest in date to the firmware, and `am7990.c` (1995)
+is the source of the descriptor-length rule that section 50 identifies as our
+payload's bug.
+
+Note on method: this tree is ~7 GB, so repo-wide `git log -S`/`--all` scans take
+minutes. Path-limited queries are immediate and were used instead:
+
+```sh
+git log --diff-filter=A --format='%ad %h' --date=short -- sys/dev/isa/if_le.c
+git show <commit>:sys/netinet/ip_icmp.c
+```