# DF-0636 VERDICT

## Verdict: REPRODUCED (dead code, v1 not vulnerable)

## Mechanism
Source: `sys/netgraph7/tty/ng_tty.c:591-607`

ngt_rcvdata accesses outq without tp->t_token.

The bug exists in ng7 (dead code). The v1 version at sys/netgraph/tty/ng_tty.c:568-594 is NOT VULNERABLE — it correctly acquires lwkt_gettoken(&tp->t_token) at line 578 BEFORE any queue access. ng7 code mutates IF_QFULL/IF_ENQUEUE/IF_DEQUEUE without the token (lines 591-598), then acquires it too late (line 604). Impact: latent bug in dead code only.

## PoC changes
- `harness.c`: replicates the vulnerable function logic demonstrating the bug.
- `fix.diff`: targeted fix for the root cause (git-apply-able).

## Fix validation
See fix_status in JSON verdict and fix_build.log/fix_run.log.