# DF-3267 -- verification pack

Finding: pf rpool->cur dereferenced without NULL guard after pool emptying

Status: **reproduced** / impact **panic** / confidence certain

## What was run
guest: cc -O -o rmpool rmpool.c (uses <net/pf/pfvar.h>)

## How to reproduce
```
guest: kldload pf; pfctl -f nat.conf (nat on lo0 ... -> 1.2.3.4); ./rmpool
```

## Expected
Fatal trap 12 page fault, fault address 0x0, in the DIOCCHANGEADDR ioctl (see panic.txt)

See VERDICT.md for the full narrative and verdict.json for the persisted
machine verdict. Artifacts: rmpool.c, panic.txt, run.log.