# DF-3214 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Bottom line

Type confusion certain by inspection: both hash-walk matches call netaddr_match(AF_INET, &rp->rc_haddr, nd->nd_nam) unconditionally regardless of whether the entry stored an IPv4 address (RC_INETADDR) or a duped sockaddr (RC_NAM, the default for non-AF_INET transports), so a v6-created entry has its rc_nam heap pointer read as an IPv4 address - 32-bit equality oracle for a spoofer and a silently inert duplicate cache for v6. Dynamic proof requires running legacy kernel nfsd on an AF_INET6 datagram socket plus source-spoofed probes; the config gate (admin sets up v6 nfsd) kept it out of this batch. Fix branches on RC_INETADDR; compile-validated.

## Kernel references
- sys/vfs/nfs/nfs_srvcache.c:194
- sys/vfs/nfs/nfs_srvcache.c:307
- sys/vfs/nfs/nfs_srvcache.c:258-275

## Exploit chain
(none: availability/correctness finding; no privilege chain)

## Fix

branch the cache-walk match on RC_INETADDR

See fix.diff in this directory (git-apply-able against the read-only sys/
tree; applied only inside the disposable verification guest).

## Reproduction

build: n/a

run: n/a (needs nfsd on a v6 socket + spoofed v4 probes)

expected: n/a

## Notes on the PoC (what changed vs the finding sketch)

(none)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.