# DF-0308 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: X_ipip_input iterates viftable/mutates last_encap_vif/derefs v_ifp with no token while del_vif/MRT_DONE bzero+reset under token; remote IPIP during vif teardown -> NULL/stale ifp deref. Requires active multicast routing.

## Impact ceiling
none

## Cited refs
- sys/net/ip_mroute/ip_mroute.c:1748

## Fix
Defensive: also reject when last_encap_vif->v_ifp == NULL (full fix needs the mrouter token around the lookup).

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.