# DF-2571 — ng_device stack VLA overflow

## Summary

**Verdict: NOT REPRODUCED** — the cited vulnerable file (`sys/netgraph/ng_device.c`)
is orphaned dead code that is not compiled into any shipping DragonFlyBSD kernel
or module and cannot even compile against the current kernel headers. The
maintained equivalent (`sys/netgraph7/ng_device.c`) already eliminated the VLA
bug. The finding's "unprivileged user" impact claim is a false positive.

See `VERDICT.md` for the full line-by-line reachability trace.

## Files

| File | Description |
|---|---|
| `trigger.c` | Minimal PoC: opens `/dev/ngd0`, does a large read()/write() to overflow the VLA |
| `build.sh` | Builds `trigger` (`cc -o trigger trigger.c`) |
| `run.sh` | Runs the trigger (checks for /dev/ngd0 first) |
| `fix.diff` | git-apply-able defense-in-depth fix: VLA → kmalloc + bounds check |
| `VERDICT.md` | Full analysis: why the bug is real in source but unreachable |
| `module_build_failure.txt` | Proof the orphaned source cannot compile |
| `env.txt` | Guest environment (uname, cc, kldstat, conf/files) |
| `build.log` / `run.log` | Build and run output |
| `manifest.json` | Machine-readable catalog |

## Build & Run

```sh
./build.sh          # cc -o trigger trigger.c
./run.sh            # checks for /dev/ngd0; on default kernel: "does NOT exist"
```

## Expected result on default kernel

`/dev/ngd0` does not exist; `ng_device` is not loaded; no effect. The orphaned
source cannot be compiled as a module (removed cdevsw API). See VERDICT.md.