# DF-0666 — VERDICT

## Verdict: NOT REPRODUCED on this kernel — cited file is DEAD CODE (not built)

The `m_devget` NULL-deref claim against `sys/netgraph/ng_device.c:589-591`
is **real at the source level**:

```c
589:	m = m_devget(buffer, len, 0, NULL);
590:
591:	NG_SEND_DATA_ONLY(error, connection->active_hook, m);
```

There is **no NULL check** on `m` after `m_devget`. If `len == 0`,
`m_devget`'s `while (len > 0)` loop never executes and it returns the
initial NULL `mfirst`. `NG_SEND_DATA_ONLY` then derefs `m->m_flags`
(`CHECK_DATA_MBUF` macro) → INVARIANTS panic, or in a non-INVARIANTS
build a NULL deref in `ng_send_data` itself.

The `len` value at `:563` is `int len = uio->uio_resid;` — a
`size_t`→`int` truncation that can wrap a huge `uio_resid` to a
negative `int`, although the surrounding `:583 if (len > 0)` gate
prevents the negative case from reaching `m_devget`.

**However**, the cited file is **not built** by any standard kernel or
module (verified identical to DF-0663/DF-0664):

```
$ grep "ng_device" sys/conf/files
netgraph7/ng_device.c		optional netgraph7_device
```

Only `sys/netgraph7/ng_device.c` is built. Its `ngdwrite`
(`sys/netgraph7/ng_device.c:452-472`) is a **complete rewrite** that
explicitly guards against exactly this bug:

```c
460:	if (uio->uio_resid == 0)
461:		return (0);                       /* <-- gates len==0 */
...
466:	if ((m = m_uiotombuf(uio, M_NOWAIT, 0, 0, M_PKTHDR)) == NULL)
467:		return (ENOBUFS);                 /* <-- NULL check */
```

The rewritten version uses `m_uiotombuf` (not `m_devget`) and has
both the `len==0` early return and the NULL check that the dead
original lacks.

## Why the live kernel cannot trigger this

Verified on the running guest (#0 build):
- `nm /boot/kernel/kernel | grep -E "ngdwrite"` → no matches
- `ls /boot/kernel/ | grep ng_device` → no module file exists
- `kldstat` → no ng_device module loaded

The OLD `sys/netgraph/ng_device.c` is dead code retained for
historical reference; netgraph7 superseded it. Same situation as
DF-0663 and DF-0664.

## Recommended fix

Delete the dead file (preferred). The bundled `fix.diff` deletes
`sys/netgraph/ng_device.c`. This **supersedes** the finding's source
proposal (add NULL check + len gate) — the netgraph7 rewrite already
has both, so patching the dead file buys nothing.