# DF-0264 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: pd.p_len = tot_len - off - (th_off<<2) is computed (line 6623) before pf_normalize_tcp; a malicious th_off makes the subtraction wrap (~0xFFFFFFxx), feeding seq tracking. Defense-in-depth (state anomaly, not memory corruption).

## Impact ceiling
none

## Cited refs
- sys/net/pf/pf.c:6623

## Fix
Guard the subtraction: set pd.p_len=0 when (th_off<<2) exceeds tot_len-off.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.