{
  "finding_id": "DF-2836",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "sonewconn_faddr (uipc_socket2.c:383) copies the listener's entire so_state into every inbound-connection socket. A listener that has been shutdown(SHUT_WR) carries SS_CANTSENDMORE, so accepted connections are born half-shut: unprivileged AF_UNIX listen+shutdown(SHUT_WR)+connect+accept yields an accepted socket whose first send(2) returns EPIPE while recv(2) on the same socket delivers the peer's data (connection provably live). Reproduced 3/3 on the stock INVARIANTS kernel; FreeBSD inherits only the NBIO bit in the same function. Fixed kernel (inherit only SS_NOFDREF|SS_ASSERTINPROG) validated: send returns 4.",
  "exploit_chain": "",
  "evidence": [
    "run.log / run.2.log: 'unix: accepted recv = 4' followed by 'unix: accepted send = -1 errno=32 [Broken pipe]'",
    "VERDICT.md: root cause path:line and fix validation",
    "fix_validation.log: same PoC on patched kernel returns send=4"
  ],
  "kernel_refs": [
    "sys/kern/uipc_socket2.c:383",
    "sys/kern/uipc_socket.c:1953",
    "sys/kern/uipc_usrreq.c:1215"
  ],
  "poc_changes": "Seed written fresh for this finding: added signal(SIGPIPE, SIG_IGN) and unbuffered stdout after the first run died of SIGPIPE (itself confirmation of the born-half-shut socket); TCP variant retained for documentation (refused at connect because shutdown(SHUT_WR) on a TCP listener stops SYN processing), AF_UNIX variant is the demonstrable path.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 420,
  "guest_dirty": 1,
  "build_cmd": "cc -O -o stateinherit stateinherit.c",
  "run_cmd": "/tmp/stateinherit (as unprivileged user)",
  "code_hash": "ea2c5e956873f0ebf2a8f02765daa3c7cc91150a79a9e4278c88b00554e0f91f",
  "notes": "Availability/correctness defect only - no memory unsafety. Canonical trigger is the graceful daemon-restart pattern (shutdown listener, keep draining accept queue).",
  "recommended_fix": "In sonewconn_faddr set so->so_state = SS_NOFDREF | SS_ASSERTINPROG (inherit no listener state bits); validated in-guest.",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Wed Sep  2 04:31:48 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (one-fix nativekernel: DF-2836 + DF-2838 edits in uipc_socket2.c)",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Applied 'so->so_state = SS_NOFDREF | SS_ASSERTINPROG' to the guest /usr/src copy, rebuilt with make nativekernel KERNCONF=X86_64_GENERIC, rebooted, re-ran the identical PoC: baseline 'accepted send = -1 errno=32' 3/3 -> patched 'accepted send = 4' with full bidirectional flow (fix_validation.log). Bad behavior gone; fix validated.",
  "fix_evidence": [
    "findings/poc/DF-2836/fix.diff",
    "findings/poc/DF-2836/fix_validation.log"
  ]
}