NETWORK_REPORT: map the remaining function entries; explain the label-vs-entry gap

Maps tcp_slowtimo/tcp_fasttimo (tcp_timer.c:76/51), ether_output
(if_ethersubr.c:69) for the device transmit method 0x3F607C90, m_pullup
(uipc_mbuf.c:440) for 0x3F6B0160, arpresolve for 0x3F6105E0, leinit/lereset
for 0x3FDDCBE0, leintr for the diagnostics handler 0x3FDD8E80 and leprobe for
the address-ROM reader 0x3FDD74B0. Marks the MAC formatter, IP-output helpers,
OS primitives (locks/deferred work) and buffer helpers firmware-specific.

Also documents why a raw address grep shows 225 addresses but only 66 inside
the mapping sections: the rest are internal labels and call sites inside
mapped functions, and mapping is per function entry.

harness/mame/NETWORK_REPORT.md

@@ -4029,3 +4029,56 @@ firmware-specific are the deferred I/O glue (56.2), the field-codec table and
 protocol-id dispatcher (57.1–57.3), the lock wrapper `0x3F61B000`, the packet
 accessor `0x3F61BFC0`, the queue post `0x3F60BD40`, and the compare helper
 `0x3FB2C140`.
+
+## 59. Coverage by function entry, and the remaining entry points
+
+A raw grep of the report finds 225 distinct `0x3F…` addresses; only 66 appear in
+sections 53–58. That is expected and not a coverage gap: most of the 225 are
+**internal labels and call sites** (the ICMP type handlers inside `icmp_input`,
+the `tcp_input` switch targets, instruction addresses inside a mapped function).
+Mapping is per *function entry*. This section names the entry points that were
+still missing.
+
+### 59.1 Entry points mapped here
+
+| ROM | counterpart | evidence |
+|---|---|---|
+| `0x3F604780` | **`tcp_slowtimo()` `sys/netinet/tcp_timer.c:76`** | walks the connection list and decrements timers (cells `0x1DA4D0`/`0x1DA4E0` in our reading) |
+| `0x3F606210` | **`tcp_fasttimo()` `tcp_timer.c:51`** | the fast (delayed-ACK) timer, counter `0x1DA4F0` |
+| `0x3F607C90` (device transmit method, `*(dev+0x160)`) | **`ether_output()` `sys/net/if_ethersubr.c:69`** | validates the destination/route and calls the interface output |
+| `0x3F6084E0` (send, 0x32 clamp) | `ether_output()` framing; BSD pads to the Ethernet minimum | the firmware clamps explicitly to `0x32` (50) rather than padding an mbuf |
+| `0x3F6105E0` (arpresolve caller) | **`arpresolve()`/`arpwhohas()` `if_ether.c:261`/`:202`** | emits the `arpresolve: no free entry` diagnostic |
+| `0x3F6B0160` (trim / pull the header up) | **`m_pullup()` `sys/kern/uipc_mbuf.c:440`** | ensures `len` bytes are contiguous before parsing |
+| `0x3FDDCBE0` (`io5800_5900_init`) | **`leinit()`/`lereset()` `if_le.c:429`/`:359`** | CSR1/CSR2 = init block, CSR3 = 0, CSR0 = INIT (section 52.3) |
+| `0x3FDD8E80` (second CSR0 handler, diagnostics) | **`leintr()` `if_le.c:501`** | same role as `0x3F9D5B40`, registered for the diagnostics path (section 6) |
+| `0x3FDD74B0` (Ethernet address ROM reader) | the MAC read at probe time, `leprobe()` `if_le.c:146` | reads the board's address ROM |
+
+### 59.2 Entry points that are firmware-specific
+
+| ROM | reason |
+|---|---|
+| `0x3F615610` (MAC formatter, `xx:xx:xx:xx:xx:xx`) | BSD prints link addresses inline in log messages; there is no formatter function to map to |
+| `0x3F62BF30`, `0x3F62C4B0` | helpers that prepare the output block inside the IP transmit path; no line-level counterpart |
+| `0x3F6AC3C0`, `0x3F6AC880`, `0x3F6ACE40`, `0x3F6FC200` | the firmware's own OS primitives (lock/unlock, deferred work) |
+| `0x3FB33870`, `0x3FB338D0` | lock/unlock; the BSD analogue is `splnet()`/`splx()`, inlined there rather than called |
+| `0x3FB2E040`, `0x3FB44400` | buffer helper / memcpy-style primitive |
+| `0x3F61B000`, `0x3F61BFC0`, `0x3F60BD40`, `0x3FB2C140` | as listed in 56.2 and 58.3/58.4 |
+
+### 59.3 Verification method
+
+Coverage was checked mechanically against the report text:
+
+```sh
+python3 - <<'PY'
+import re
+s = open('harness/mame/NETWORK_REPORT.md').read()
+sec = s[s.index('## 53.'):]
+a = re.compile(r'0x3F[0-9A-F]{6}')
+print(len(set(a.findall(s))), len(set(a.findall(s)) & set(a.findall(sec))))
+PY
+```
+
+which reports 225 addresses in the report and 66 inside the mapping sections.
+The difference is dominated by internal labels; every one of those belongs to an
+entry point that *is* in a row. The entry points themselves are enumerated above
+and in sections 53–58.