{
  "finding_id": "DF-2934",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Info hardening finding, no PoC applicable (kernel-internal exported API with no user-reachable length parameter; all 21 in-tree callers pass constants or already-16-bit values). m_tag_alloc (sys/kern/uipc_mbuf2.c:256-268) allocates len+sizeof(struct m_tag) bytes but stores int len into uint16_t m_tag_len (and int type into uint16_t m_tag_id) — silent length/ID mismatch for any future/module caller passing len > 0xFFFF. No integer overflow on x86-64; no in-tree exploitant; one-line bounds guard recommended.",
  "exploit_chain": "",
  "evidence": [
    "sys/kern/uipc_mbuf2.c:260-267 — len<0 checked, then t->m_tag_len = len (int -> uint16_t) after kmalloc(len + sizeof(struct m_tag))",
    "sys/sys/mbuf.h:138-143 — struct m_tag { uint16_t m_tag_id; uint16_t m_tag_len; uint32_t m_tag_cookie; }",
    "findings/poc/DF-2934/VERDICT.md — full pass-2 kill-list (13 classes traced and closed with path:line)"
  ],
  "kernel_refs": [
    "sys/kern/uipc_mbuf2.c:256",
    "sys/kern/uipc_mbuf2.c:266",
    "sys/sys/mbuf.h:141",
    "sys/sys/mbuf.h:64"
  ],
  "poc_changes": "none — no PoC seed applicable to a kernel-internal API hardening gap",
  "attempts": 0,
  "guest_uname": "n/a (Info finding — Phase V skipped per audit contract)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 re-audit of sys/kern/uipc_mbuf2.c. DF-0161 (tag order reversal) verified STILL PRESENT at uipc_mbuf2.c:376-381 (tprev=t inside else branch) — known, not re-reported. Cross-refs for other files' audits: m_tag_locate consumers that read tag data without validating m_tag_len — ng_tag.c:537 memcmp, ng_ksocket.c:904-907, if.c:2956 — all root-gated on DF via netgraph control-socket caps_priv_check (ng_socket.c:182).",
  "recommended_fix": "In m_tag_alloc, reject len/type outside uint16_t range: if (len < 0 || len > 0xFFFF || type < 0 || type > 0xFFFF) return NULL;"
}