# DF-0664 — PoC evidence pack

## Summary
- **File:** `sys/netgraph/ng_device.c` (OLD netgraph v0 device)
- **Claim:** Missing locking across all 6 cdevsw entry points enables TOCTOU/UAF.

## Verdict
**NOT REPRODUCED on this kernel** — cited file is dead code (not in
`sys/conf/files`; superseded by `sys/netgraph7/ng_device.c` which has
proper locking). Same dead-code conclusion as DF-0663. See `VERDICT.md`.

## How to "reproduce" (the source-level analysis only)
No build or run is needed: the cited file is not compiled, so there is
no live binary to run against. The `verify_dead_code.sh` script just
re-confirms the conf/files exclusion + absence from the running kernel's
symbol table + absence of a loadable module.

```sh
./verify_dead_code.sh    # prints the three negative checks
```

## Environment
See `env.txt` for the guest `uname`, kldstat, and the conf/files grep.

## Fix
`fix.diff` deletes the dead `sys/netgraph/ng_device.c`. This supersedes
the finding's source-level locking proposal — patching a file that is
not compiled in buys nothing; the netgraph7 rewrite has none of these
bugs.