# DF-0706 — PoC

Lifecycle bugs in ipfw3 sync edge handler cleanup (UAF on replaced
edge_sock, missing thread join, soclose+sofree imbalance, dangling
`ipfw_sync_send_state_prt`).

## Build

```
./build.sh
```
Requires DragonFlyBSD `cc` (gcc 8.3 on master guest).

## Run

```
ssh dfbsd         # root
cd poc/DF-0706
./run.sh
```

`run.sh` `kldload`s `ipfw3.ko` + `ipfw3_basic.ko` then fires every
`IP_FW_SYNC_*` opcode via `IP_FW_X`. On the default kernel **every
opcode returns `rc=0 errno=0` with no effect** — the dispatcher falls
through because `ip_fw3_ctl_sync_ptr` is never assigned. Guest stays
up, no panic. This proves the cited lifecycle bugs cannot fire on a
default kernel.

**Do NOT `kldunload ipfw3_basic`** after this test: there is a
separate, unrelated panic in `rn_flush()` (radix-tree cleanup) on
this master build that is NOT the DF-0706 bug. The serial log will
show `Stopped at rn_flush+0x1d`. (Reset the guest with `vm.sh reset`
if you accidentally trigger it.)

## Expected

All `IP_FW_SYNC_*` opcodes return success with no observable effect;
guest stays up. See `VERDICT.md` for the full dead-code analysis and
`fix.diff` for the defensive fix.