# DF-0430 — PoC evidence pack

**Finding:** Unauthenticated `PFSYNC_ACT_CLR/DEL/DEL_C` let attacker
mass-destroy arbitrary pf state across every CPU.
**Severity (filed):** High
**Verdict:** NOT REPRODUCED — **FALSE POSITIVE (dead code)**
**Impact:** none

## TL;DR
DF-0430 cites `case PFSYNC_ACT_CLR:` (`if_pfsync.c:542-608`), `DEL` (`:749`)
and `DEL_C` (`:873`) — all arms of the `switch (action)` inside
**`pfsync_input()`** (a single function spanning `if_pfsync.c:462-1006`).
`pfsync_input` is **dead code**: the only registration site
(`sys/netinet/in_proto.c:281-296`) is wrapped in `#ifdef NPFSYNC`, and
`NPFSYNC` is never defined anywhere in `sys/`, so the handler is never
registered and no proto-240 packet can reach it. This is the identical
root cause proven exhaustively for the sibling finding **DF-0428**.

## Files
| file | purpose |
|---|---|
| `VERDICT.md`        | full narrative + evidence |
| `inject_clr.c`      | crafts the exact CLR(ifname="",creatorid) mass-delete trigger packet |
| `build.sh`          | `cc -o inject_clr inject_clr.c` |
| `run.sh`            | inject + show zero pfsync activity |
| `build.log`         | full build output |
| `run.log`           | decisive run: injection → no state deletion, no pfsyncstats |
| `env.txt`           | guest uname, pf/pfsync state, nm checks |
| `manifest.json`     | machine-readable catalog |

## Reproduce
```
./build.sh
# (root on guest): kldload pf.ko; pfctl -e
./run.sh          # run as root (raw socket); expect NO state deletion, NO pfsyncstats
```

Expected on master DEV: the CLR packet is sent, but `pfsync_input` is never
invoked (symbol absent from `kernel.debug`; no proto-240 handler registered),
so no pf state is deleted. `pfsyncstats` stays empty.

## Fix
No code change needed — false-positive. See `VERDICT.md` § Recommended fix.