# DF-0495 detailed verdict

## Verdict: NOT REPRODUCED (claimed panic does not manifest); real latent underflow

## Claim vs reality
The finding (CWE-191, A:H) claims a **kernel panic** from `bcmp` reading a
~2⁶⁴-byte region after `(klen - head_off)` underflows. Source confirms the
underflow is real (`sys/net/radix.c:884-889`, no `klen >= head_off` check;
reachable via `RTM_DELETE` because `rt_xaddrs` at `sys/net/rtsock.c:1034` only
rejects `sa_len==0`). **But the panic does not occur on default GENERIC:**
DragonFly's `bcmp` (MEMCMP macro, `asm_mjgmacros.h`) short-circuits on the first
16-byte mismatch, and INVARIANTS slab poisoning guarantees a mismatch within a
chunk or two, so `bcmp` returns non-zero long before reaching an unmapped page.
`rn_delete` returns `NULL` ⇒ userspace `ESRCH`. No crash.

Empirically confirmed: `sin_len ∈ {1,2,3}` (< `rn_offset=4` for AF_INET) via
`RTM_DELETE` all return `ESRCH`, guest stays up, no panic in `boot.log`.

## Classification
`status = not_reproduced` for the **claimed impact (panic)**: the bug path is
exercised but the claimed effect does not manifest on this kernel. The
integer-underflow defect itself is genuine and worth fixing (defense-in-depth);
the realistic impact ceiling is a benign `ESRCH` plus a theoretical
layout-dependent OOB read that is non-exploitable on GENERIC. The Medium/A:H
severity is **overstated** — this is closer to a Low/Info hardening defect.

## Privilege boundary
`socket(PF_ROUTE, SOCK_RAW, ...)` requires `SYSCAP_RESTRICTEDROOT`
(`sys/net/raw_usrreq.c:195`). Root-only ⇒ root→kernel; no unpriv→root chain.

## Fix (defense-in-depth)
`fix.diff`:
```c
if (klen < head_off || tt == NULL || bcmp(...) != 0) return (NULL);
```
Validated: applied + compiled + booted as part of the combined single-fix
kernel (#1, `kern.version` "...#1: Sat Jul 18 17:19:50 UTC 2026"). On the
patched kernel the probe still returns `ESRCH` (no regression) and the
underflow path is closed deterministically rather than relying on `bcmp`'s
short-circuit. Because the claimed panic never reproduced, there is no runtime
before/after crash contrast ⇒ `fix_status = not_testable` (fix validated as
applies+compiles+boots and traced to close the path).

## Why no chain
The primitive would be an OOB *read* of underflowed length, but it
short-circuits before reading anything useful, and the path is root-only. No
write, no corruption, no leak — there is no escalation chain to develop.