# DF-2596 - Verification Verdict

**Status:** reproduced
**Impact:** none (hardening)
**Confidence:** certain

## Mechanism
After truncating the mbuf to the filter return value (m_adj(m, -(totlen - len))), the code updates totlen -= len instead of totlen = len, so totlen becomes original_len - truncated_len, which equals the new length only when original == 2*len.

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Stats-only corruption: the subsequent xmit hook accounting adds the wrong octet count (e.g. 100-byte packet truncated to 30 reports 70 instead of 30). Arithmetic is deterministic; no runtime rig built (netgraph plumbing for a stats-only wrong number was not worth the guest cycle budget in this Info batch).

## Threat / reachability
Latent code defect; see VERDICT.md.

## Privilege escalation assessment
n/a (hardening)

## Fix
totlen = len;

## Kernel references
- `sys/netgraph/bpf/ng_bpf.c:414`
- `sys/netgraph/bpf/ng_bpf.c:416`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.