{
 "finding_id": "DF-3262",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "leak",
 "confidence": "likely",
 "verdict": "The validation gap is demonstrated live: an O_VIA glob rule whose 16-byte name has no NUL byte installs through IP_FW_ADD (only the instruction length is checked at ip_fw2.c:5482) and shows in ipfw -S list, while a properly terminated control rule matches traffic. Rigorous source analysis of libkern fnmatch shows the out-of-bounds pattern read is genuinely reachable but oracle-only: the default, ? and leading-* branches consume pattern in lockstep with the string (bounded by if_xname, <= 15 chars + NUL), but an unterminated [ opens rangematch()s bracket scan, which walks pattern bytes until a ] or an EOS byte - past the 16-byte name, through the rest of the rule, into adjacent heap when no zero byte intervenes. The result is a match/no-match oracle on adjacent kernel heap bytes with no crash or disclosure path; classification is therefore not_reproduced for want of an observable manifestation, with the gap and the reachability analysis on record.",
 "exploit_chain": "",
 "evidence": "run.log (non-NUL rule installed and listed, zero matches vs NUL-terminated control matching), VERDICT.md fnmatch branch analysis",
 "kernel_refs": [
  "sys/net/ipfw/ip_fw2.c:1355",
  "sys/net/ipfw/ip_fw2.c:5480-5483",
  "sys/libkern/fnmatch.c:56-175"
 ],
 "poc_changes": "",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "guest: addset via 2000 <16-byte-name> (same tool as DF-3261)",
 "run_cmd": "guest: addset via 2000 vtnet0[AAAAAAAAA; ipfw -S list; traffic; ipfw show 2000",
 "code_hash": "",
 "notes": "",
 "recommended_fix": "require memchr(name, 0, IFNAMSIZ) at install for O_RECV/O_XMIT/O_VIA"
}