# DF-0429 — PoC evidence pack

**Finding:** Unauthenticated `PFSYNC_ACT_UREQ` (`id==0 && creatorid==0`)
forces victim to multicast entire pf state table (info disclosure + DoS).
**Severity (filed):** High
**Verdict:** NOT REPRODUCED — **FALSE POSITIVE (dead code)**
**Impact:** none

## TL;DR
DF-0429 cites `case PFSYNC_ACT_UREQ:` at `sys/net/pf/if_pfsync.c:900-949`,
which is an arm of the `switch (action)` inside **`pfsync_input()`**
(a single function spanning `if_pfsync.c:462-1006`). `pfsync_input` is
**dead code**: the only registration site
(`sys/netinet/in_proto.c:281-296`) is wrapped in `#ifdef NPFSYNC`, and
`NPFSYNC` is never defined anywhere in `sys/`, so the handler is never
registered and no proto-240 packet can reach it. This is the identical
root cause proven exhaustively for the sibling finding **DF-0428**.

## Files
| file | purpose |
|---|---|
| `VERDICT.md`        | full narrative + evidence |
| `inject_ureq.c`     | crafts the exact UREQ(id=0,creatorid=0) trigger packet |
| `build.sh`          | `cc -o inject_ureq inject_ureq.c` |
| `run.sh`            | inject + show zero pfsync activity |
| `build.log`         | full build output |
| `run.log`           | decisive run: injection → no bulk dump, no pfsyncstats |
| `env.txt`           | guest uname, pf/pfsync state, nm checks |
| `manifest.json`     | machine-readable catalog |

## Reproduce
```
./build.sh
# (root on guest): kldload pf.ko; pfctl -e
./run.sh          # run as root (raw socket); expect NO bulk dump, NO pfsyncstats
```

Expected on master DEV: the UREQ packet is sent, but `pfsync_input` is never
invoked (symbol absent from `kernel.debug`; no proto-240 handler registered),
so no bulk state-table dump occurs. `pfsyncstats` stays empty.

## Fix
No code change needed — false-positive. See `VERDICT.md` § Recommended fix.