{
 "finding_id": "DF-2966",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "Deterministic panic through the exact cited sink. On the stock kernel a kld harness registered a domain whose optional pru hooks were NULL (replicating the uipc_domain.c:138->:140 kldload window state) and unpriv userland then: socket(AF=99, SOCK_STREAM, 0) SUCCEEDED (fd handed out - socreate only validates pru_attach, uipc_socket.c:217) and a following listen/shutdown/accept dispatched the NULL hook into netisr: panic: netmsg_service isr N badmsg - the netisr.c:336 INVARIANTS KASSERT on NULL nm_dispatch (production kernels call NULL directly at :370). Window on real systems opens only when a domain-registering module loads after boot (ng_socket family, privileged kldload); plain ordering bug, hit even on strongly-ordered x86. Fix validated A/B on the patched kernel via the REAL net_add_domain path: stubs are installed before publication, socket ops return clean errors, no panic. The naive reorder (full net_init_domain before insert) was tried first and BREAKS BOOT (panic: ip_init) - dom_init depends on prior publication; the validated fix splits the NULL-fills (pre-publish) from dom_init/pr_init (post-publish).",
 "exploit_chain": "",
 "evidence": "df2966_panic2.txt: panic netmsg_service badmsg; df2966_sock.log: socket succeeded in half-published domain; getpeername alone early-returns ENOTCONN (noted)",
 "kernel_refs": [
  "sys/kern/uipc_domain.c:138",
  "sys/kern/uipc_domain.c:140",
  "sys/kern/uipc_socket.c:217",
  "sys/net/netisr.c:336"
 ],
 "poc_changes": "getpeername on an unconnected socket early-returns ENOTCONN before dispatch; listen/shutdown/accept on the same socket dispatched the NULL; fix A/B harness registers via net_add_domain (raw SLIST insert bypasses the fix and was only used on stock)",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 120,
 "guest_dirty": 1,
 "build_cmd": "make (KMOD dfv_boom); cc dfv6sock2.c",
 "run_cmd": "sysctl -w dfvboom.d2966=1; as unpriv: ./dfv6sock2",
 "code_hash": "dda19f1f5b27d94055ace3c314348bae1185bdc330304be9f0aa36bb0947d71d",
 "notes": "root-triggered kldload window; unpriv racer converts to panic",
 "recommended_fix": "initialize before publishing (net_init_domain ahead of SLIST_INSERT_HEAD)",
 "fix_status": "fixed",
 "fix_verdict": "A/B on fix kernel #2: domain registered through the REAL net_add_domain with NULL optional hooks; unpriv socket+listen+shutdown return errors, NO panic (stock panicked: netmsg_service badmsg). NOTE: the naive fix (full net_init_domain before publish) BREAKS BOOT (panic: ip_init - dom_init requires prior publication); the validated fix stubs the optional hooks pre-publication (net_init_domain_fill) and keeps dom_init/pr_init after insertion.",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0
}