# DF-3294 -- verification pack

**Method:** Live PoC on the QEMU guest (stock INVARIANTS kernel)
**Status:** REPRODUCED | impact: denial_of_service | confidence: certain

## What this is
No challenge-ACK rate limiting exists anywhere in tcp_input.c (grep -i challenge: zero hits; no sysctl either). Live measurement on lo0: 300 spoofed out-of-window segments produced 304 ack-only packets (netstat counter delta) - a 1:1 ACK amplification with zero limiting (CVE-2016-5696 family: unthrottled ACK side channel enables off-path RST/SYN injection inference).

## Build
```
cc -O -o <prog> <prog>.c   (on the guest)
```

## Run
```
300 (root)
```
(success criterion: see VERDICT.md)

## Evidence
live1.log DF-3294 section: ack-only delta=304 for 300 OOW segments; tcpdump saw 303 pkts from server

Kernel references: sys/netinet/tcp_input.c:2563-2600