# DF-2365 - Verification Verdict

**Status:** reproduced
**Impact:** none (hardening)
**Confidence:** certain

## Mechanism
In _chacha20poly1305_mbuf decryption the final partial block is decrypted into the local block by _chacha20poly1305_final (line 351-352) and then written back into the mbuf by m_copyback (line 354) UNCONDITIONALLY - before the tag comparison result is even returned; the whole stream is likewise decrypted in place during the update loop.

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Only in-tree caller is wg_noise.c:1027 (WireGuard), which frees the mbuf on EBADMSG, so the unauthenticated plaintext is discarded - impact is design hygiene (any future caller that forwards the mbuf despite the error would emit unverified plaintext). fix.diff stops the TAIL write-back on authentication failure; buffering the whole stream would require an API redesign (documented, not attempted).

## Threat / reachability
Design hygiene: decrypt-before-verify; current callers discard on error.

## Privilege escalation assessment
n/a (hardening)

## Fix
Skip the tail m_copyback when ret != 0 (comment documents the residual in-place loop).

## Kernel references
- `sys/crypto/chachapoly.c:351`
- `sys/crypto/chachapoly.c:354`
- `sys/net/wg/wg_noise.c:1027`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.