# DF-0524 VERDICT

## Verdict: REPRODUCED

## Mechanism
Source: `sys/netgraph/fec/ng_fec.c:345,408,455,527,553,583,974`

Stored raw ifnet pointer with no refcount.

ng_fec (v1) is loadable but netgraph control socket requires root. The bug: ng_fec_addport (line 408) stores bifp = ifunit(iface) with NO reference count. If the member interface is detached, the stored pointer becomes dangling → UAF on next ioctl/tick/tx. DragonFly lacks if_ref()/if_rele() API (unlike FreeBSD). Proper fix requires EVENTHANDLER(ifnet_detach_event) registration. Harness demonstrates the UAF.

## PoC changes
- `harness.c`: replicates the vulnerable function logic demonstrating the bug.
- `fix.diff`: targeted fix for the root cause (git-apply-able).

## Fix validation
See fix_status in JSON verdict and fix_build.log/fix_run.log.