# DF-0509 VERDICT

## Verdict: FALSE POSITIVE

## Mechanism
Source: `sys/netgraph/ksocket/ng_ksocket.c:325,655-656`

Stack overflow via negative pathlen.

The ng_ksocket BIND/CONNECT sanity check (lines 655, 717) does NOT validate sa_len >= SADATA_OFFSET, allowing a short sockaddr to pass. HOWEVER, defense-in-depth in unp_bind (sys/kern/uipc_usrreq.c:1141-1143) validates namelen = sun_len - offsetof(sockaddr_un, sun_path) and rejects <= 0. So a short sockaddr is never stored and ng_ksocket_sockaddr_unparse never receives one. The finding's claim that 'sobind accepts short sockaddr' is incorrect on DragonFly. The unparse function has a latent vulnerability but it is NOT triggerable. Fix.diff adds the missing check as defense-in-depth hardening.

## PoC changes
- `harness.c`: replicates the vulnerable function logic demonstrating the bug.
- `fix.diff`: targeted fix for the root cause (git-apply-able).

## Fix validation
See fix_status in JSON verdict and fix_build.log/fix_run.log.