# DF-0304 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: carp_clone_destroy kfrees sc without zeroing sc_key[20]/sc_pad[64]/sc_sha1; slab reuse may later disclose the CARP HMAC key. Defense-in-depth info-leak.

## Impact ceiling
leak

## Cited refs
- sys/netinet/ip_carp.c:723
- sys/netinet/ip_carp.c:307

## Fix
bzero sc_key/sc_pad/sc_sha1 before kfree(sc).

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.