# DF-0309 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: X_ip_mforward allocates mfc+rtdetq+m_copypacket per distinct (src,grp) cache miss; MAX_UPQ bounds per-flow but there is no global cap on stalled entries -> remote multicast flood of distinct flows drives unbounded mbuf/kmalloc pressure while the token is held. Requires active mrouter.

## Impact ceiling
dos

## Cited refs
- sys/net/ip_mroute/ip_mroute.c:1256

## Fix
Documented the missing global stall-entry cap; full fix needs a global counter with eviction/backoff. Comment-only (compiles).

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=not_testable.