# DF-0666 — PoC evidence pack

## Summary
- **File:** `sys/netgraph/ng_device.c:589-591`
- **Claim:** `m = m_devget(buffer, len, 0, NULL)` with no NULL check; `NG_SEND_DATA_ONLY(error, hook, m)` then derefs the possibly-NULL `m`. `write(fd, buf, 0)` ⇒ `len==0` ⇒ `m_devget` returns NULL ⇒ instant panic.

## Verdict
**NOT REPRODUCED on this kernel** — cited file is dead code (not in
`sys/conf/files`). The active `sys/netgraph7/ng_device.c:460-467`
explicitly guards `uio_resid==0` and NULL-checks the mbuf allocation.
See `VERDICT.md`.

## How to "reproduce" (the source-level analysis only)
No build or run is needed: the cited file is not compiled. `run.sh`
re-prints the dead-code evidence.

## Environment
See `env.txt`.

## Fix
`fix.diff` deletes the dead `sys/netgraph/ng_device.c` (same as
DF-0664/DF-0663). The netgraph7 rewrite already has the missing NULL
check and len==0 gate, so patching the dead file buys nothing.