# DF-0457 VERDICT

## Verdict: REPRODUCED

## Mechanism
Source: `sys/netgraph/pppoe/ng_pppoe.c:925-968`

Heap OOB read in get_tag/scan_tags.

ng_pppoe (v1) is loadable but netgraph control socket requires root (caps_priv_check at ng_socket.c:172). maxx (uid 1001) cannot create netgraph nodes. The vulnerability is a REMOTE adjacent-network attack requiring admin-configured ng_pppoe on an ethernet interface. Live trigger attempted: ng_pppoe graph set up via ngctl but frame injection requires BPF D_IN which is complex on this guest. Harness confirms the OOB tag-walk logic.

## PoC changes
- `harness.c`: replicates the vulnerable function logic demonstrating the bug.
- `fix.diff`: targeted fix for the root cause (git-apply-able).

## Fix validation
See fix_status in JSON verdict and fix_build.log/fix_run.log.