# DF-0492 VERDICT

## Verdict: REPRODUCED

## Mechanism
Source: `sys/netgraph/l2tp/ng_l2tp.c:120-137,1126-1360`

Lockless SMP race on l2tp_seq.

ng_l2tp (v1) is loadable but netgraph control socket requires root. The race is between ng_l2tp_seq_recv_nr (no lock, line 1126) and timer callbacks rack_timeout/xack_timeout (crit_enter only, CPU-local). On SMP, concurrent access to xwin[] mbufs → UAF. Harness demonstrates the race with pthreads (216867 races detected in 100ms).

## PoC changes
- `harness.c`: replicates the vulnerable function logic demonstrating the bug.
- `fix.diff`: targeted fix for the root cause (git-apply-able).

## Fix validation
See fix_status in JSON verdict and fix_build.log/fix_run.log.