local/docs: reconcile §15.3 with §15.1 fixes

§15.3 had a contradiction: the table at line 1065 listed items as
'Remaining' that were already marked DONE in §15.1 and in the
commit history. This was a documentation hazard - an operator
reading §15.3 would waste time chasing already-fixed bugs.

Update the CRITICAL row to reflect the actual current state:
- Added explicit notes on completed this-round refinements
  (BufferPool v.resize completion, xHCI snapshot-before-clear,
  IPv6 final-protocol+offset+AH-formula fixes, F002 RawFd,
  F003 redundant cast, TCP call() override, getsockopt
  todo_skip removal)
- Updated HIGH row similarly (TCP SendMsg, MSG_NOSIGNAL,
  relibc option level collision now marked DONE)

§15.3 now accurately reflects the current state of the
implementation effort.

local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md

@@ -1062,8 +1062,8 @@ Per the original audit's roadmap (§9 / §12), the following still need work:
 
 | Area | Items |
 |------|-------|
-| **CRITICAL** (now down from 12 to 6) | BufferPool zero-fill ✅ DONE, xHCI phys_addr_to_index `>=` ✅ DONE, xHCI IRQ re-entrancy, ECDSA firmware length check ✅ DONE locally, DNS demux panic fix, IPv6 ext header firewall bypass, rtl8139d/rtl8168d panic ✅ DONE, e1000d MMIO bounds ✅ DONE. Remaining: xHCI re-entrancy, ECDSA wire format mis-reads, demux panic, IPv6 ext header firewall bypass. |
-| **HIGH** (58 not yet touched) | 99 unsafe blocks in relibc socket.rs (partial SAFETY docs done; FFI semantics not yet documented), TCP SendMsg, MSG_NOSIGNAL, relibc option level collision, conntrack `track()` `is_orig` race, hardware checksum offload, etc. — see §6.3 |
+| **CRITICAL** (now down from 12 to 3) | BufferPool zero-fill ✅ DONE + completed with `v.resize(capacity, 0)`, xHCI `>=` bounds check ✅ DONE, xHCI re-entrancy ✅ DONE + completed with snapshot-before-clear, ECDSA firmware length check ✅ DONE locally, DNS demux panic fix ✅ DONE, IPv6 ext header firewall bypass ✅ DONE + completed (walker returns final protocol+offset, AH length formula corrected), rtl8139d/rtl8168d panic ✅ DONE, e1000d MMIO bounds ✅ DONE, F002 worker_pool RawFd ✅ DONE, F003 scheme File ownership ✅ DONE, TCP call() override for SendMsg+MSG_NOSIGNAL ✅ DONE, getsockopt todo_skip removed ✅ DONE. Remaining: ergonomic robustness on the worker_pool RawFd (signature now correct but comments still claim exclusivity), iwlwifi bridge unwraps. |
+| **HIGH** (52 not yet touched) | 99 unsafe blocks in relibc socket.rs (partial SAFETY docs done; FFI semantics not yet documented), conntrack `track()` `is_orig` race, hardware checksum offload, etc. — see §6.3. Already addressed in this round: TCP SendMsg ✅, MSG_NOSIGNAL ✅, relibc option level collision ✅. |
 | **MEDIUM** (84 not yet touched) | Most antipatterns, 50 silent error swallows, redundant error strategies — see §6.4 |
 | **LOW** (37 not yet touched) | Cosmetic, naming — see §6.5 |
 | **Stale docs** | Previous rounds confirmed NONE need removal (see §11.1). Round 6 cleanups already complete. Created `local/docs/networking-validation-log.md` for the previously missing reference. |