# DF-2966 - verification verdict

Status: **reproduced** | reproduced: 1 | impact: panic | confidence: certain

Deterministic panic through the exact cited sink. A kld harness replicated the mid-window state of net_add_domain (uipc_domain.c:138 SLIST_INSERT_HEAD publishes, :140 net_init_domain fills NULLs - harness published a domain with valid pru_attach and NULL pru_peeraddr/pru_shutdown/...). Unpriv userland: socket(AF=99, SOCK_STREAM, 0) SUCCEEDED (fd handed out - socreate only validates pru_attach, uipc_socket.c:217), then a subsequent sockop dispatched the NULL hook into netisr: panic: netmsg_service isr N badmsg - the netisr.c:336 INVARIANTS KASSERT firing on NULL nm_dispatch (on production kernels :370 calls NULL directly). Window on real systems opens only when a domain-registering module loads (ng_socket etc., privileged kldload); plain ordering bug, hit even on strongly-ordered x86. Fix (initialize before publishing) A/B validated on the fix-all kernel.

## Evidence pointers
df2966_panic2.txt: panic netmsg_service badmsg; df2966_sock.log: socket succeeded in half-published domain; getpeername alone early-returns ENOTCONN (noted)

## Kernel references
- sys/kern/uipc_domain.c:138
- sys/kern/uipc_domain.c:140
- sys/kern/uipc_socket.c:217
- sys/net/netisr.c:336

## PoC changes vs the filing sketch
getpeername on an unconnected socket early-returns ENOTCONN before dispatch; the NULL dispatch came from the following listen/shutdown/accept family on the same socket

## Fix
recommendation: initialize before publishing (net_init_domain ahead of SLIST_INSERT_HEAD)

fix status: fixed

A/B on fix-all kernel: same socket+ops sequence returns clean errors, no panic

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.