# DF-0329 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: icmp6_redirect_output pads the quoted packet to an 8-byte boundary by extending m0->m_len WITHOUT zeroing the new bytes; the trailing cluster space holds leftover bytes from prior mbuf reuse -> stale heap bytes checksummed into the redirect. Info-leak.

## Impact ceiling
leak

## Cited refs
- sys/netinet6/icmp6.c:2567

## Fix
bzero the new (8-extra) trailing bytes before extending m0->m_len.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.