=== DF-0636: ng_tty ngt_rcvdata token race ===

FINDING FILED AGAINST: sys/netgraph7/tty/ng_tty.c:591-607

ng7 version (DEAD CODE — not compiled on master):
  ngt_rcvdata (line 591-607):
    IF_QFULL(&sc->outq)      // NO token held
    IF_ENQUEUE(&sc->outq, m) // NO token held
    qlen = sc->outq.ifq_len  // NO token held
    lwkt_gettoken(&tp->t_token) // ACQUIRED TOO LATE (line 604)
    ngt_start(sc->tp)
  -> BUG CONFIRMED: queue mutated before token acquired
  -> Impact: SMP race -> queue corruption / UAF write

v1 version (sys/netgraph/tty/ng_tty.c — ng_tty.ko, LOADABLE):
  ngt_rcvdata (line 568-594):
    lwkt_gettoken(&tp->t_token) // line 578: CORRECT — before any access
    // all queue ops under token
    lwkt_reltoken(&tp->t_token) // line 590
  -> NOT VULNERABLE: correct locking

CONCLUSION:
  The bug exists in ng7 source but ng7 is dead code on master.
  The loadable v1 ng_tty.ko is NOT vulnerable (has correct locking).
  Impact: latent bug in dead code; fix for completeness.
RUN_EXIT=0