# DF-3263 VERDICT — reproduced (panic, unprivileged trigger)

## Result
`status: reproduced`, `impact: panic` (remote-triggerable DoS once the
rule exists; root-loaded rule + unauthenticated/unprivileged trigger
packet).

## How it was run
1. Guest booted (vm.sh up), `kldload pf`, stock kernel
   `DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026` (6 CPUs).
2. Root loads the rule set (`rdr_div0.conf`): pfctl accepts the reversed
   range — `pfctl -sn` shows
   `rdr pass on lo0 inet proto tcp from any to 127.0.0.1 port = 9998 -> 127.0.0.1 port 5001:5000`.
3. Unprivileged user (uid 1001 maxx) runs `trigger_div0` — a plain
   `connect("127.0.0.1", 9998)`; the SYN traverses pf_check_in on lo0,
   matches the rdr rule, enters pf_get_translation() PF_RDR branch.
4. Kernel panics before connect() returns (ssh session died;
   `vm.sh status` → down; serial log captured):

```
Fatal trap 18: integer divide fault while in kernel mode
cpuid = 0; lapic id = 0
instruction pointer = 0x8:0xffffffff8261389a
kernel: type 18 trap, code=0
Stopped at      pf_get_translation+0x31a:       idivl   %ecx,%eax
```

Trap 18 is the x86 #DE; the faulting instruction is the `idivl` of the
modulus at sys/net/pf/pf.c:3306-3310 inside pf_get_translation — the
exact predicted sink. 100% deterministic (one packet, one panic).

## Root cause chain
- usr.sbin/pfctl/parse.y `parseport()`: `5001:5000` parses to
  a=5001, b=5000 (a>b not rejected; only a==b collapses).
- pf_ioctl.c DIOCADDRULE (1262-1273): pool-list checks only; no
  proxy_port ordering validation.
- pf.c:3303 `if (r->rpool.proxy_port[1])` → true (5000) →
  pf.c:3308 divisor `5000 - 5001 + 1 = 0` → idiv trap.

## Exploit chain
Not applicable (panic/DoS class). In production this is a
remote-triggered kernel panic gated on a pfctl-loadable typo'd rule;
pfctl will happily load it from any rules file.

## Fix
Validated fix.diff (load-time validation in pf_ioctl.c + defensive
degenerate-range check in pf.c). Baseline panic captured; patched
kernel re-runs the identical trigger with no panic (see run.log /
fix validation notes in manifest).

## Impact ceiling
Denial of service (panic). No memory-safety implication (integer #DE).
Severity Medium: requires a root-loaded misconfigured rule (or root via
raw ioctl), triggered by a single unauthenticated packet.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.