# DF-0366 PoC — lagg_start lockless sc_count check races port destroy

**Status:** INCONCLUSIVE — code-level race confirmed; not won in test.
**Severity:** Medium

## Bug
`sys/net/lagg/if_lagg.c:1758-1763` reads `sc->sc_count` as an
early-exit guard **without** holding `LAGG_RLOCK`. The handler then
acquires `LAGG_RLOCK` at line 1766 and calls `sc_select_tx_port`,
which in round-robin mode (line 1860) does `p %= sc->sc_count`. If
`lagg_port_destroy` (line 770, under `LAGG_WLOCK`) decrements
`sc_count` 1→0 in the window between the lockless check and the
RLOCK acquire, the modulo divides by zero → CPU trap → kernel panic.

## Reproduce
```sh
./race.sh         # root: creates lagg0 RR with tap0+tap1, floods UDP, flaps ports 200x
```
In our test the race did not trigger in 200 iterations (window is
narrow). The code pattern is unambiguously racy; heavier traffic or
more CPUs would win it.

## Files
- `race.sh`      — shell-based race trigger
- `fix.diff`     — move LAGG_RLOCK above the early-exit, re-validate inside lock
- `VERDICT.md`   — full narrative
- `env.txt`