# DF-0306 PoC — UAF in add_bw_upcall

## Status: REAL (source-trace confirmed), not reproduced at runtime

The bug is a genuine use-after-free confirmed by source trace of
`sys/net/ip_mroute/ip_mroute.c:2285-2326`. It is **not compiled**
into the default GENERIC kernel (`options MROUTING` required) and
is **root-only** (requires `SYSCAP_NONET_RAW` for the raw IGMP
socket needed by `MRT_INIT`).

No runtime PoC is provided because:
1. The code is not in the default kernel.
2. The race window is the `M_INTWAIT` kmalloc duration — too narrow
   to reliably win without memory-pressure grooming.
3. The entire multicast routing API requires root.

## Fix

See `fix.diff` — holds `mroute_token` across the `kmalloc` to
prevent concurrent `del_mfc()`/`MRT_DONE` from freeing `mfc`.