# DF-0297 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: ng_name_node scans name[0..NG_NODESIZ-1] and, if no terminator is found, reads name[NG_NODESIZ] (1 byte past the 32-byte field) in the subsequent name[i]!='\0' check. Root-only, 1-byte intra-struct read.

## Impact ceiling
none

## Cited refs
- sys/netgraph/netgraph/ng_base.c:573

## Fix
Bound the check: also reject when i>=NG_NODESIZ so name[NG_NODESIZ] is never read.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.