# DF-0303: CARP HMAC Precomputed Context Torn-Read Race

## Finding
`carp_hmac_prepare()` (ip_carp.c:504) rewrites `sc_sha1` in-place. The code
admits `/* XXX: possible race here */` at line 517. `carp_hmac_generate()`
(line 556) and `carp_hmac_verify()` (line 575) bcopy `sc_sha1` on any CPU.
No lock/barrier. Torn SHA1_CTX causes legitimate adv to fail HMAC → failover
disruption.

## Reproduction
Code-confirmed. Race requires concurrent SIOCSVH ioctl (carp_hmac_prepare)
+ packet input (carp_hmac_generate) on different CPUs. The CARP receive path
cannot be exercised on this QEMU guest. The bug is self-evident from the
XXX comment at line 517 and the unlocked bcopy at line 562.

## Fix
See fix.diff — adds crit_enter/crit_exit around sc_sha1/sc_pad writes in
carp_hmac_prepare and the bcopy in carp_hmac_generate.