# DF-3299 -- verification pack

**Method:** Code-line analysis + attempted live reproduction
**Status:** NOT REPRODUCED | impact: none | confidence: likely

## What this is
carp_group_demote_adj (ip_carp.c:2765-2781) does an unlocked RMW on ifg_carp_demoted and an unlocked group walk, and carp_send_ad_all runs in the caller context; the cross-CPU callers are pfsync_input (any netisr CPU, if_pfsync.c:985) vs pfsyncioctl (user thread, :1162). The demote counter is not exposed to userspace and pfsync was not configured, so no manifestation could be driven or observed; mechanism line-confirmed only (NOTES.md folded in).

## Build
```
cc -O -o <prog> <prog>.c   (on the guest)
```

## Run
```
(none)
```
(success criterion: see VERDICT.md)

## Evidence
NOTES.md (prior static analysis) + ip_carp.c:2765-2781 excerpt in VERDICT.md

Kernel references: sys/netinet/ip_carp.c:2765-2781, sys/net/pf/if_pfsync.c:985, sys/net/pf/if_pfsync.c:1162