# DF-0312 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: the loopback branch uses s6_addr16[1] as an ifindex into ifindex2ifnet[] with no bounds check (contrast IPV6_PKTINFO which validates against if_index); a crafted raw socket with a bogus zone id -> OOB read. Kernel addr-selection normally prevents.

## Impact ceiling
none

## Cited refs
- sys/netinet6/in6.c:565

## Fix
Bounds-check the zone id (>= if_index -> ENXIO) before use, mirroring the IPV6_PKTINFO path.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.