# DF-0744 — PoC evidence pack

**`udp6_output` corrupts sticky socket options and leaks per-call options
memory when `ip6_setpktoptions` fails.** Severity: Medium.

## Build

```sh
./build.sh
```
(compiles `corrupt.c` and `leak.c` with `cc -O2 -Wall -Wextra`)

## Run

```sh
./run.sh
```
(runs as the unprivileged user; needs IPv6 loopback `::1`)

## Expected on the **buggy** kernel (`6.5-DEVELOPMENT #0`)

* **Corruption test:** sticky `IPV6_PKTINFO` (set to `::42`) is silently
  **cleared to `::`** by a single failed `sendmsg`. Exits with code 2 and
  prints `VERDICT: BUG`.
* **Leak test:** `vmstat -m | grep ip6opt` shows the `ip6opt` slab
  **Count and MemUse grow** by ~20 B per `sendmsg` iteration (4000 iters
  → ~+94 KB of `M_IP6OPT`).

## Expected on the **fixed** kernel (single-fix `#1`)

* **Corruption test:** sticky `IPV6_PKTINFO` is **preserved**. Exits 0 and
  prints `VERDICT: SAFE`.
* **Leak test:** `ip6opt` slab **Count stays at 0**; only the `Requests`
  column climbs (proving the calls happened but allocations were freed).

## Files

See `VERDICT.md` for the full mechanism writeup and `manifest.json` for
the artifact catalog. The fix is `fix.diff` (one-line; `git apply`-able).