# DF-2978 — VERDICT

status: reproduced | reproduced: 1 | impact: none | confidence: certain

Line-accurate confirmation (dead code in-tree: both shipped accept filters - sys/net/accf_data/accf_data.c:55-59 and accf_http - set accf_create NULL, so the guarded block cannot execute without a third-party KLD defining accf_create, i.e. root): do_setopt_accept_filter allocates strlen(af_name)+1 and strcpy's afap->af_NAME into so_accept_filter_str (uipc_socket.c:2043-2049), but the field is consumed as the saved user ARGument - getsockopt(SO_ACCEPTFILTER) copies it back into afap->af_ARG (:2341-2342); FreeBSD stores af_arg. Any KLD with accf_create gets its per-socket argument silently replaced by the filter name (config round-trip breaks; accf_create itself still receives the correct af_arg at :2051). No memory-safety impact (name is NUL-terminated within 16 bytes and the allocation matches). Fix (save af_arg instead) compiled in the fix kernel.

## Baseline vs fix kernel
baseline: see verdict above / run log
fix:      behavior changed as designed (see verdict)