The following command ends up blocking the device:
host:

while true; do cansend vcan0 134#00; done

guest:

candump can0

I observe that the device stops to consume descriptors from the rx queue. After debugging, the problem seems the way descriptors from the rx queue are consumed from the available ring. In

1. Guest enqueues D1, D2
2. A frame f1 arrives
3. Iter() gets D1, D2
4. Use D1 for F1
5. D2 is never used

Guest is able to reuse those descriptors that are marked as used and added to the used ring but not those that are lost. The situation ends up when there are no more available ring to reuse, which blocks the devices.

Also req_rx_buf is never really used (see