# DF-0676 PoC — ng_one2many XMIT_ALL double-free / UAF

## Build
```
cd findings/poc/DF-0676
./build.sh        # -> ng_o2m_df.ko
```

## Run (as root; harness replays the XMIT_ALL m_dup-NULL error path deterministically)
```
# baseline (double-free):
kldload ./ng_o2m_df.ko            # hw.df0676.apply_fix defaults to 0
dmesg | grep DF0676

# fixed (NGI_GET_M detach, no double-free):
kldunload ng_o2m_df
kenv hw.df0676.apply_fix=1
kldload ./ng_o2m_df.ko
dmesg | grep DF0676
```

## Expected
- **Baseline** (`apply_fix=0`): `address 0x... returned 2 time(s)` → double-free aliasing
  (UAF). The mbuf objcache does NOT trap the double-free on GENERIC, so it is silent.
- **Fixed** (`apply_fix=1`): `_NGI_M(item)=0` after the error path; `address 0 returned
  0 time(s)` → no double-free.

The real fix is `fix.diff` (add `NGI_GET_M(item, m);` before the `NG_FREE_ITEM/NG_FREE_M`
pair in `ng_one2many_rcvdata`).