BUILD_EXIT=0
-rwxr-xr-x  1 maxx  maxx  8736 Jul 18 18:15 df0510
DF-0510: ng_ksocket7 thread0 fallback analysis

Source expression (3 sites):
  struct thread *td = curthread->td_proc ? curthread : &thread0;
                                                ^^^^^^^^^
                                                uid=0 root creds

When netgraph msg processing is deferred (runs from a kernel
thread / softirq / netisr), curthread->td_proc is NULL:
  td chosen   = &thread0 (ROOT CREDS)
  td->td_ucred= root cred (uid=0, all groups, all caps)

This td is then passed to:
  - socreate()  -> PRIV_NET_RAW / SOCK_RAW evaluated as root
  - sobind()    -> PRIV_NET_PRIV_PORT (<1024) as root
                   jail address binding check bypassed
  - soconnect() -> firewall bypass evaluated as root
  - sosend()/soreceive() -> all priv checks as root

Realistic trigger: jailed root creates ng_ksocket, msg
processing deferred to kernel thread -> all ops run with
host-root creds instead of jail-restricted cred.
(Jail/capsicum sandbox escape via ng_ksocket.)

REACHABILITY: ng_ksocket is driven via netgraph messages.
socket(AF_NETGRAPH) is root-only, so unprivileged users
cannot directly reach this code path.  The defect matters
for jailed/capsicum-restricted root contexts.

Fix: see fix.diff — refuse the op when td_proc==NULL
(matches finding's suggested fix: 'refuse when td_proc==NULL
or store crhold at node creation').
RUN_EXIT=0