6. Known limitations and non-passing checks

6.1 One failure — the dataplane NIC attribution check

test_vpp_owns_dataplane_nics failed. It is a true positive, and it is the
only failing check in the run.

The console sorts NICs into kernel, DPDK and VPP. A NIC is attributed to
VPP only when it appears in the stored port-assignment list — the bucket
records an assignment an operator made, not what VPP is driving. This box's
ports were never assigned through the console, so its two 40GbE NICs are
correctly shown as DPDK-bound (drv=vfio-pci) but never attributed to VPP,
while VPP forwards on them throughout this run.

The dataplane is unaffected, and this report is the evidence. The same box,
in the same run, onboarded 5,000 subscribers, moved 30 GB, held QoS on 480 of
480 subscribers and forwarded 13.57 Mpps. Onboarding, forwarding, QoS and the
session cap do not consult this list.

What does depend on it is a guard: the same stored list makes the devbind
bind / unbind / reset-to-kernel endpoints refuse an operation on a port VPP is
using. With the list empty that guard is not armed, so such a request is carried
out rather than refused — and it re-renders the dataplane configuration. Nothing
does this unprompted; it requires an operator or a script to ask.

Workaround: assign the dataplane ports on the Dataplane page during
commissioning, before the box carries subscribers. On a box already in service,
do not use those controls to correct the display — use a planned maintenance
window. Tracked as #49.

6.2 Four skipped checks

A skip is a precondition that was absent, not a pass. All four are expected:

Check	Why it skipped
`test_throughput_recent_nonzero_under_load`	The aggregate throughput panel showed non-zero correctly, but the per-IP sampler has a known gap. Tracked as console `#48`.
`test_lockout_after_failures_then_admin_unlock`	The per-IP login rate limit (5 per 300 s) trips before the per-account lockout threshold can be reached from a shared source IP. The two protections are mutually exclusive from one address; the rate limit is the one that fired.
`test_a_captive_session_reports_its_lease`	Known gap, expected on a 1.4.0 controller — a captive session reports no usable lease stamp. Fixed for 1.5, tracked upstream as controller `bng#48` — a different tracker from the console `#48` above. Not a test limitation.
`test_upstream_dscp_remark_bits`	Not run — the skip reason is stale. The test carries `xfail(run=False)` with the reason "DSCP remark ACTION ships in the next major release". That stopped being true in 1.3.0: `bng_access_input.c` calls `bng_mark_dscp()` on both colours, and the codepoints are configurable per direction (green AF11 / yellow AF12 by default, marking off by default). The shipped feature therefore has no coverage in this run. Raised as a test defect; the marking behaviour itself was not exercised here either way.

6.3 Scale limits worth stating

This is a 5,000-subscriber report and should not be read as a 25,000 one.

Session reclamation at high scale. At 18,750 concurrent subscribers under
sustained churn, the controller's session view stops reclaiming released
sessions. Nothing is lost — orphans were zero in every run — but the count
stays at its high-water mark. Reproduced at 10,000; clean at 5,000 and
below, as this run shows (integrity 1.0, zero leaks). Traced upstream to two
defects, both fixed in controller 1.5. Tracked as bng#50.
The 25,000 cap is not validated by this run. The platform has been proven
to 18,750 concurrent sessions. The 25,000 figure is the licence grant's
ceiling, not a measured result.
Console polling scales with session count. Each console page re-fetches
the full session list on a timer, so controller load scales with
(tabs × pages × loops). At high session counts that request can be slow or
fail; 1.4.0 makes such a failure visible rather than rendering an empty table,
but retiring the full-list pull is #14. Prefer fewer simultaneously-open
console tabs during a scale test or maintenance window.
No forwarding ceiling is established in either direction by §5.6. The
policer carried 32.9 GB downstream and 30.7 GB upstream and classified every
byte, but those are the shaping workload's offered rates, not a search for a
limit. Forwarding limits are §5.7's subject, and there only 4 of 20 cells
found one.
Lease renewal under churn is not exercised (§5.5).