# Virtio split descriptor chain ownership contract (K1481–K1485)

This bounded direct-descriptor model follows [Virtio 1.3, sections 2.7.5 and 2.7.13](https://docs.oasis-open.org/virtio/virtio/v1.3/virtio-v1.3.html). A validated modern Virtio queue with size at most 1024 owns its descriptor table, available ring, used ring and data buffers.

- Each descriptor is a 16-byte little-endian record with physical address, length, flags and next index. A submitted chain visits distinct indices below queue size, ends without NEXT, has no address overflow, and totals no more than 2^32 bytes. Device-readable descriptors precede device-writable descriptors. INDIRECT is rejected unless a later negotiated indirect-table owner validates it; this prototype publishes direct chains only.
- Claiming a chain atomically reserves all its descriptor indices under one generation. An overlapping or malformed chain changes no ownership. Two disjoint chains may coexist. Reusing an index after reclaim receives a new generation; a stale handle cannot act on it.
- Publication follows complete descriptor and available-ring writes plus a release barrier. Once exposed, the driver cannot cancel or modify descriptors or buffers. Completion requires a matching used-ring head and a used length within the writable span. Reclaim is allowed after matching completion, or after device reset has been physically observed with status and queue enable both zero.
- A prepared, unexposed chain can be canceled and returned. An exposed chain remains owned if completion or reset is uncertain. The local model represents these gates; it cannot prove physical DMA completion or cache ordering.
- K1485 development acceptance requires a real QEMU Virtio device to consume a disposable direct chain, write a buffer, return its head in the used ring, and permit reclamation in six direct and UEFI 256, 512 and 1024 MiB guests. Product release acceptance remains separate.