# DF-0248 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: accept_filt_get traverses the accept-filter SLIST with no lock while accept_filt_add/del mutate it under crit_enter only; the author admits no refcounting. Stale/unmapped callback -> panic on kldunload race. Unpriv setsockopt vs kldunload.

## Impact ceiling
none

## Cited refs
- sys/kern/uipc_accf.c:104

## Fix
Wrap accept_filt_get's traversal in crit_enter()/crit_exit() to match the writers (partial; cross-CPU still needs a refcount).

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.