# DF-2966 PoC evidence pack

## What
net_add_domain publishes before net_init_domain fills NULL hooks: socket in the window dispatches NULL -> panic.

## Build
```
make (KMOD dfv_boom); cc dfv6sock2.c
```

## Run
```
sysctl -w dfvboom.d2966=1; as unpriv: ./dfv6sock2
```

## Expected
panic: netmsg_service isr N badmsg after socket(AF=99)+sockop on the half-published domain

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
All logs are full untrimmed captures unless noted. fix.diff is the
git-apply-able verified fix (authored after verification; never applied
to the audit tree).