# DF-0336 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: tcp6_getcred does SYSCTL_OUT(req, inp->inp_socket->so_cred, ...) directly (IPv4 twin copies to a stack local first); copyout can sleep and the connection can be torn down during the sleep -> ucred UAF. Root-only (caps RESTRICTEDROOT).

## Impact ceiling
leak

## Cited refs
- sys/netinet/tcp_subr.c:1387

## Fix
Copy so_cred into a stack-local ucred under crit, then crit_exit before the sleeping SYSCTL_OUT.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.