diff --git a/local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md b/local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
index 4e86cfd455..8fe85bef5b 100644
--- a/local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
+++ b/local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
@@ -1015,6 +1015,8 @@ incrementally; this is a rolling changelog.
 | **CRITICAL F1.6** | **xHCI `>=` bounds check fix** | `submodule/base 3a3af825` → parent `22bd63bbe2` | `local/sources/base/drivers/usb/xhcid/src/xhci/ring.rs` |
 | **DEF-P0-7** | rtl8139d/rtl8168d panic → graceful exit | `submodule/base 3a3af825` → parent `22bd63bbe2` | `local/sources/base/drivers/net/rtl{8139,8168}d/src/main.rs` |
 | **DEF-P0-6** | e1000d MMIO register bounds check | `submodule/base 3a3af825` → parent `22bd63bbe2` | `local/sources/base/drivers/net/e1000d/src/device.rs` |
+| **CRITICAL F1.1** | **xHCI re-entrancy: clear event TRB before state.finish()** | `submodule/base 51ae1567` → parent `4fc85b9be4` | `local/sources/base/drivers/usb/xhcid/src/xhci/irq_reactor.rs` (4 call sites) |
+| **CRITICAL F3.1** | **libredox demux: replace .expect() with .unwrap_or(u16::MAX)** | `submodule/libredox bfb5f8b` → parent `7aba4f84ed` | `local/sources/libredox/src/lib.rs` |
 | **F22 (btintel)** | **ECDSA firmware length check** | `(uncommitted)` | `local/recipes/drivers/redbear-btusb/source/src/btintel.rs` |
 | **F21 (dnsd wiring)** | **Wire redbear-dnsd into redbear-mini** | `6b105c7cee` | `config/redbear-mini.toml` ([packages] + [init] 11_dnsd.service) |
 | **ghost-recipe docs** | **netd/audiodevd/usbd WIP per AGENTS.md** | `6b105c7cee` | `local/recipes/system/{netd,audiodevd,usbd}/recipe.toml` |