diff --git a/local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md b/local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
index 890ad8492e..c95ada08cd 100644
--- a/local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
+++ b/local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
@@ -1062,8 +1062,8 @@ Per the original audit's roadmap (§9 / §12), the following still need work:
 
 | Area | Items |
 |------|-------|
-| **CRITICAL** (now down from 12 to 6) | BufferPool zero-fill ✅ DONE, xHCI phys_addr_to_index `>=` ✅ DONE, xHCI IRQ re-entrancy, ECDSA firmware length check ✅ DONE locally, DNS demux panic fix, IPv6 ext header firewall bypass, rtl8139d/rtl8168d panic ✅ DONE, e1000d MMIO bounds ✅ DONE. Remaining: xHCI re-entrancy, ECDSA wire format mis-reads, demux panic, IPv6 ext header firewall bypass. |
-| **HIGH** (58 not yet touched) | 99 unsafe blocks in relibc socket.rs (partial SAFETY docs done; FFI semantics not yet documented), TCP SendMsg, MSG_NOSIGNAL, relibc option level collision, conntrack `track()` `is_orig` race, hardware checksum offload, etc. — see §6.3 |
+| **CRITICAL** (now down from 12 to 3) | BufferPool zero-fill ✅ DONE + completed with `v.resize(capacity, 0)`, xHCI `>=` bounds check ✅ DONE, xHCI re-entrancy ✅ DONE + completed with snapshot-before-clear, ECDSA firmware length check ✅ DONE locally, DNS demux panic fix ✅ DONE, IPv6 ext header firewall bypass ✅ DONE + completed (walker returns final protocol+offset, AH length formula corrected), rtl8139d/rtl8168d panic ✅ DONE, e1000d MMIO bounds ✅ DONE, F002 worker_pool RawFd ✅ DONE, F003 scheme File ownership ✅ DONE, TCP call() override for SendMsg+MSG_NOSIGNAL ✅ DONE, getsockopt todo_skip removed ✅ DONE. Remaining: ergonomic robustness on the worker_pool RawFd (signature now correct but comments still claim exclusivity), iwlwifi bridge unwraps. |
+| **HIGH** (52 not yet touched) | 99 unsafe blocks in relibc socket.rs (partial SAFETY docs done; FFI semantics not yet documented), conntrack `track()` `is_orig` race, hardware checksum offload, etc. — see §6.3. Already addressed in this round: TCP SendMsg ✅, MSG_NOSIGNAL ✅, relibc option level collision ✅. |
 | **MEDIUM** (84 not yet touched) | Most antipatterns, 50 silent error swallows, redundant error strategies — see §6.4 |
 | **LOW** (37 not yet touched) | Cosmetic, naming — see §6.5 |
 | **Stale docs** | Previous rounds confirmed NONE need removal (see §11.1). Round 6 cleanups already complete. Created `local/docs/networking-validation-log.md` for the previously missing reference. |