#!/bin/sh
# DF-0489 run script.
# This finding is a FALSE POSITIVE: nd6_lookup(create=0) returns a route with
# NET-ZERO reference change (route.c:276 ++ is balanced by nd6.c:929 --), so
# nd6_na_input has nothing to free and does NOT leak.
#
# This script documents the code trace. The BPF injector (poc_df0489.c) and the
# netgraph injector (poc_df0489_ng.c) were used to attempt empirical
# confirmation; both confirmed no refcount change (BPF writes go TX not RX;
# netgraph naming ioctl unsupported on this build). The definitive proof is the
# source trace itself.
echo "DF-0489 = FALSE POSITIVE."
echo "Finding claims nd6_na_input leaks a route refcount per NA because"
echo "nd6_lookup acquires a reference (route.c:276 ++) and nd6_na_input never"
echo "calls rtfree(). The claim MISSES nd6.c:929 (rt->rt_refcnt--) which is"
echo "inside nd6_lookup itself and UNCONDITIONALLY undoes the ++ before the"
echo "route is returned. Net reference change = 0 -> nothing to free -> no leak."
echo ""
echo "Key citations:"
echo "  route.c:276   rt->rt_refcnt++   (inside _rtlookup, via rtpurelookup)"
echo "  nd6.c:929     rt->rt_refcnt--   (inside nd6_lookup, unconditional, before return)"
echo "  nd6_nbr.c:734 rt = nd6_lookup(&taddr6, 0, ifp)  (create=0 -> returns unreferenced)"
echo ""
echo "No other caller of nd6_lookup(addr, 0, ifp) calls rtfree either, confirming"
echo "the convention that create=0 returns a route with no holding reference."