{
 "finding_id": "DF-3266",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "denial_of_service",
 "confidence": "likely",
 "verdict": "Half verified, half refuted-in-practice: pfctl ACCEPTS a NAT pool whose port range includes 0 (nat ... port 0:65535 loads verbatim), and the downward loop for (tmp = cut - 1; tmp >= low; --tmp) with u_int16_t tmp provably underflows to 0xffff at low==0 (condition always true) - pf.c:3033. But saturating all candidate ports was not achievable on this rig: an external-destination fill wedges the QEMU slirp backend (65K pending host connects) before saturation, and a loopback fill collapses to ~10.7K concurrent states (local RSTs tear the half-open states down; a listener variant did not change the ceiling) while 194 million state-table searches were billed at 3.4M/s during the fill. The trigger connect therefore always found a free port (or was EPERM-blocked by pf) and never entered the unterminating loop. Admin-config-dependent DoS; fix (clamp low to 1, as the ICMP path already does) compile-validated.",
 "exploit_chain": "",
 "evidence": "run.log x2: rule accepted with port 0:65535; fill runs, state ceilings, searches 194030438 at 3464829.2/s, trigger outcomes",
 "kernel_refs": [
  "sys/net/pf/pf.c:3033-3050",
  "sys/net/pf/pf.c:3010-3012"
 ],
 "poc_changes": "v1 used deliberately broken TCP checksums, which pf drops with EPERM from the raw sender; v2 computes correct checksums; destination moved inside the guest after the slirp wedge",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 400,
 "guest_dirty": 0,
 "build_cmd": "guest: cc -O -o fillsyn fillsyn.c (raw SYN injector with valid checksums)",
 "run_cmd": "guest: pfctl -f conf (port 0:65535 nat on lo0), fillsyn 127.0.0.1 9 fill, then trigger",
 "code_hash": "a68084c302f5e4b68de7f6de24f90992de00d3a4cac3c32f2bd9ad83977b272c",
 "notes": "fill ceilings: ~10.7K concurrent states on lo0 (local RST teardown); external variant wedges QEMU slirp before saturation",
 "recommended_fix": "clamp low to 1 after the range swap"
}