# DF-0490 — Type confusion in `in_lifaddr_ioctl` (AF_INET6 typo) — REPRODUCED

## Result
**REPRODUCED.** `sys/netinet/in.c:911` uses `AF_INET6` inside the IPv4 handler
`in_lifaddr_ioctl` instead of `AF_INET`. The loop skips IPv4 addresses, matches
IPv6 addresses, and casts an `in6_ifaddr *` to `in_ifaddr *` (line 923) — a
genuine type confusion. `ia_addr` is then read from offset 312 (`in_ifaddr`
layout) when the actual `in6_ifaddr` has it at offset 240.

`SIOCGLIFADDR` is **reachable by an unprivileged user** (no privilege check at
`in.c:443-446`). On the default GENERIC config the demonstrated effect is a logic
error (SIOCGLIFADDR returns all-zero/wrong data instead of the IPv4 address);
0 bytes of kernel memory leak because the mis-typed `sin_len` position reads 0.

## Reproduce
```
./build.sh && ./run.sh vtnet0
```
- **BUGGY (#0 kernel):** `SIOCGLIFADDR` returns `ss_family=-1, ss_len=0, all-zeros`.
- **FIXED (#1 kernel):** returns `decoded IPv4 addr: 10.0.2.15`.

## Fix
`sys/netinet/in.c:911`: change `AF_INET6` → `AF_INET`. See `fix.diff`
(git-apply-able, **validated** by single-fix kernel build + boot + re-run).
Matches the finding markdown's recommended fix.

## Validation
- Baseline (`#0`): type-confused empty output.
- Patched (`#1`, sha256 `64bbd4f7…`): correct IPv4 address; deterministic over 2 runs.

See `VERDICT.md` for the full mechanism, offset math, reachability, and evidence.