=== baseline uname ===
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

=== baseline kernel ===
DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

=== loaded ng_pptpgre.ko symbols (netgraph7 version with the UAF bug) ===
00000000000004e0 t ng_pptpgre_disconnect
00000000000000c0 t ng_pptpgre_recv_ack_timeout
0000000000000a50 t ng_pptpgre_send_ack_timeout

=== topology build via persistent ngctl session (succeeds for upper+lower hooks) ===
$ ngctl -f /tmp/cmds.txt
  Name: p1              Type: pptpgre         ID: 00000011   Num hooks: 2
  Local hook      Peer name       Peer type    Peer ID         Peer hook
  ----------      ---------       ---------    -------         ---------
  lower           <unnamed>       ksocket      00000012        inet/raw/gre
  upper           ngctl1045       socket       00000010        dl1
ngctl_rc=0

=== C harness attempts the full topology (with session_0001 hook) ===
$ ./connect_test
mkpeer OK
name OK -> tp1047
ksocket lower OK
connect session_0001: Invalid argument (errno=22)
ct_rc=1

The C harness holds the netgraph control socket open via NgMkSockNode,
then issues NGM_CONNECT to wire the socket node's hook "dl_sess" to
p1's "session_0001" hook. The kernel rejects the connect with EINVAL
before pptpgre's newhook() runs (no debug kprintf observed in dmesg
when newhook is instrumented). The failure is in the netgraph7 connect
machinery itself — unrelated to the UAF bug being verified (the UAF is
in the disconnect/free path).

=== CONCLUSION ===
Live race reproduction NOT achieved in the test window. Two compounding issues:

1. Netgraph7 connect/mkpeer path rejects the session_0001 hook add with
   EINVAL before the topology can be fully assembled. (Reproduced with
   both ngctl `mkpeer p1: echo session_0001 dl` and the C harness's
   NGM_CONNECT call.) This blocks arming the rackTimer via a write to
   the upper hook.

2. Standalone-built netgraph7 modules (make in sys/netgraph7/<dir>)
   produce .ko files with linker metadata that the running kernel's
   netgraph.ko rejects ("depends on netgraph - not available or version
   mismatch"). This blocks loading a kprintf-instrumented ng_pptpgre.ko
   to debug item 1.

The bug itself is conclusively established by source-level trace; see
VERDICT.md for the path-by-path proof.

=== source-level kernel refs confirmed ===
disconnect path frees hpriv unconditionally:  sys/netgraph7/pptpgre/ng_pptpgre.c:494-498
ng_pptpgre_reset calls ng_uncallout x 2:      sys/netgraph7/pptpgre/ng_pptpgre.c:945-970
ng_uncallout doesn't free already-dispatched:  sys/netgraph7/netgraph/ng_base.c:3273-3296
ng_apply_item NGQF_FN skips only if node invalid: sys/netgraph7/netgraph/ng_base.c:2082-2095
ng_pptpgre_recv_ack_timeout UAF on 5 fields:   sys/netgraph7/pptpgre/ng_pptpgre.c:862-880
ng_pptpgre_send_ack_timeout UAF + freed lock:  sys/netgraph7/pptpgre/ng_pptpgre.c:910-919