# DF-0296: Netgraph Hook UAF / Cross-Node Race

## Finding
`ng_findhook()` (ng_base.c:791) returns a hook pointer without taking a
reference. Callers dereference `hook->peer->node` and deeper chains with
only the local node's reader token. `ng_destroy_hook()` frees peer hooks
and nodes concurrently under TOPOLOGY_WLOCK. Path resolution, LISTHOOKS,
and ng_con_part2 are all affected. Root-only (ng_socket requires root).

## Reproduction
This is a code-confirmed finding. Runtime reproduction requires:
1. Root access (netgraph control sockets require `caps_priv_check(SYSCAP_RESTRICTEDROOT)`)
2. Concurrent hook destruction + path resolution on multi-CPU

The netgraph code IS available (`kldload netgraph` → already loaded).

To reproduce:
```
kldload netgraph
# As root: create nodes, connect hooks, concurrently destroy + resolve paths
```

## Fix
See fix.diff — adds `ng_ref_hook()` and uses it in path resolution to
protect `hook->peer->node` dereference.