# DF-0274 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: if_addmulti_serialized kmalloc(sa->sa_len)+bcopy(sa, dupsa, sa->sa_len) trusts the user-controlled sa_len (up to 255) which can exceed the copyin'd ifr storage -> heap over-read. Reachable via SIOCADDMULTI.

## Impact ceiling
leak

## Cited refs
- sys/net/if.c:2667
- sys/net/if.c:2703

## Fix
Add a sa_len sanity guard in if_addmulti_serialized; full fix belongs in the SIOCADDMULTI copyin path (documented).

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.