# DF-0307 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: mfctable/viftable are exported verbatim via SYSCTL_OPAQUE CTLFLAG_RD; struct mfc/vif carry kernel pointers (mfc_next/stall/bw_meter, v_ifp/tbf/rsvpd/route) -> any unpriv user reads raw kernel addresses (KASLR bypass).

## Impact ceiling
leak

## Cited refs
- sys/net/ip_mroute/ip_mroute.c:90
- sys/net/ip_mroute/ip_mroute.c:95

## Fix
Add CTLFLAG_NOLOCK to the exported tables (mitigation; full fix should scrub pointers). Note: keeps RD; the deeper fix is a priv gate/scrub.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.