# DF-0669 — PoC evidence pack

## Summary
- **File:** `sys/net/ipfw3_basic/ip_fw3_table.c:130` (also `:248`, `:583`)
- **Claim:** `rn_flush(table_ctx->node, ...)` is called without a NULL
  check; `table_ctx->node` is NULL (M_ZERO init) until
  `IP_FW_TABLE_CREATE` runs `rn_inithead`. Calling DELETE/FLUSH on an
  in-bounds table id that was never created, or `kldunload`ing
  `ipfw3_basic` after normal use, panics in `rn_flush` at
  `head->rnh_walktree` with `head == NULL`.

## Verdict
**REPRODUCED — kernel panic (root-only trigger)**. See `VERDICT.md`
and `panic.txt`.

## Reproduce
```sh
./build.sh           # builds df0669_ipfw3_null
# Run as root, e.g. via vm.sh (ipfw3 default-deny severs ssh, so the
# test runs locally and writes its output to /dev/console):
ssh dfbsd 'kldload ipfw3; kldload ipfw3_basic; /root/poc/DF-0669/df0669_ipfw3_null 74'
# Expected: Fatal trap 12 page fault @ VA=0x28; guest reboots (debugger_on_panic=0)
# or drops into DDB (debugger_on_panic=1).
```

## Environment
See `env.txt`.

## Fix
`fix.diff` adds `if (table_ctx->node != NULL)` guards before each of
the three vulnerable `rn_flush` calls (in `table_delete_dispatch`,
`table_flush_dispatch`, and the `ip_fw3_table_fini_dispatch` unload
loop). `git apply --check` passes. **Matches the finding proposal.**