# DF-0310 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: ip6_id++ (line 753) is a non-atomic RMW with no lock/crit; concurrent netisr CPUs race -> lost increments, duplicate IDs, more predictable sequence (weakens fragment ID as an off-path-injection authenticator).

## Impact ceiling
none

## Cited refs
- sys/netinet6/ip6_output.c:753

## Fix
Use atomic_fetchadd_int(&ip6_id, 1) for the increment.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.