{
  "finding_id": "DF-3044",
  "title": "BOOTP/DHCP reply acceptance has zero origin validation and a fully deterministic transaction XID",
  "manifest_version": 1,
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "on the guest: sh build.sh  (sha256-gates bootp_subr.c to the audited tree, adds vfs/nfs/dfrig12_bootp.c via conf/files, make -j6 nativekernel KERNCONF=X86_64_GENERIC && make installkernel; reboot)",
    "run": "sysctl -w kern.dfrig12=2; sysctl -n kern.dfrig12_status  (blind predicted-XID spoof from 6.6.6.6:9999); kern.dfrig12=20 wrong-xid control; on a dedicated boot kern.dfrig12=4 panics via the verbatim decode path",
    "expected": "test 2 baseline: client DISCOVER xid bytes 0100ffff == predicted; verbatim console shows Received DHCP Offer/Ack ... (accepted); decode line adopts attacker yiaddr/siaddr, hostname pwn3d, rootfs 6.6.6.6:/pwn3d, swapfs 6.6.6.6:/swpwn, router; markers hostname ADOPTED / root NFS mount ADOPTED / default route ADOPTED / origin requested 0 times. test 4 baseline: panic bootpc: subnet mask len is 3. Fixed kernel: xid differs (karc4random), sniff+port9999 rejected with bootpc: reply not from server port 67, ignored; test 4 no panic; sniff+port67 still accepted (documented same-L2 residual)."
  },
  "kernel_refs": [
    "sys/vfs/nfs/bootp_subr.c:807-808",
    "sys/vfs/nfs/bootp_subr.c:831-852",
    "sys/vfs/nfs/bootp_subr.c:429-435",
    "sys/vfs/nfs/bootp_subr.c:1194-1196",
    "sys/vfs/nfs/bootp_subr.c:1538",
    "sys/vfs/nfs/bootp_subr.c:1341-1515",
    "sys/vfs/nfs/bootp_subr.c:1644-1666",
    "sys/vfs/nfs/bootp_subr.c:1142-1148",
    "sys/vfs/nfs/bootp_subr.c:1389-1391"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "dfrig12_bootp.c", "build.sh", "run.sh",
    "run.log", "run.fixed.log", "panic.txt", "panic_console_full.txt",
    "fix_validation.log", "fix.diff", "fix_combined.diff",
    "build.log", "build_fixed.log", "env.txt", "manifest.json", "verdict.json"
  ]
}