# DF-3274 -- verification pack

**Method:** Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
UAF read of the freed mbuf pkthdr (obytes accounting, all three sppp send sites); live sppp unreachable on guest (no standalone cloner: ifconfig sppp0 create -> EINVAL), verbatim-code guard-page harness faults deterministically; value feeds only the obytes counter (netstat -i).

## Build
```
./build.sh
```

## Run
```
df3274 uaf
```
(success criterion: see VERDICT.md)

## Evidence
control (read-before-free order) rc=0; stock order (free-then-read) faults the guard page rc=139; FIXED build clean (fixruns.log DF-3274 FIXED-OK)

Kernel references: sys/net/sppp/if_spppsubr.c:1372-1380, sys/net/sppp/if_spppsubr.c:1429-1438, sys/net/sppp/if_spppsubr.c:4672-4681