# DF-0298 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: ng_make_node_common increments node->refs/type->refs with no lock (author XXX); ng_rmtype/MOD_UNLOAD check refs unlocked -> lost update -> type vtable freed while a node still references it -> UAF. Root-only (netgraph).

## Impact ceiling
none

## Cited refs
- sys/netgraph/netgraph/ng_base.c:398

## Fix
Guard the refs++ and the undo decrement with crit_enter()/crit_exit() (matches ng_unref's existing crit).

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.