# DF-1384 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
TOCTOU race in nge_jref vs nge_jfree: unlocked check-then-add enables refcount confusion / UAF on jumbo buffers

## Source Location
sys/dev/netif/nge/if_nge.c:1148-1192

## Verdict
Source-confirmed (complex fix): TOCTOU race in nge_jref vs nge_jfree: unlocked check-then-add enables . No diff in batch.

## Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build

## Summary
nge_jref at if_nge.c:1148-1164: reads nge_inuse==0 (unlocked), then atomic_add. nge_jfree :1183-1191 takes nge_jslot_serializer around subtract+SLIST_INSERT_HEAD. Race: jref reads inuse=1 -> jfree subtracts to 0, inserts on free list -> jref atomic_add back to 1 -> slot on free list AND in-use -> nge_jalloc hands same slot to new RX desc while original mbuf still references it -> UAF. Trigger: m_ext sharing (m_copym/m_dup_pkthdr) + concurrent free. Fix: take nge_jslot_serializer around check+inc