# DF-3300 — SIOCSVH accepts advbase=0 (missing lower-bound validation)

## Static claim

sys/netinet/ip_carp.c:2463-2474 (`carp_ioctl_setvh_dispatch`):

```c
if (carpr->carpr_advbase > 0 || carpr->carpr_advskew > 0) {
        if (carpr->carpr_advskew >= 255) { error = EINVAL; goto back; }
        if (carpr->carpr_advbase > 255)  { error = EINVAL; goto back; }
        sc->sc_advbase = carpr->carpr_advbase;   /* 0 accepted here */
        sc->sc_advskew = carpr->carpr_advskew;
        error--;
}
```

There is no `advbase <= 0` rejection: a request carrying advskew>0 and
advbase=0 stores `sc_advbase = 0`, which collapses the advertisement
interval to tick-resolution (`tv.tv_sec = 0`) in carp_setrun()
(ip_carp.c:1839-1841) and the master-down timeout to `3*0 = 0` s
(ip_carp.c:1812). FreeBSD's carp validates
`carpr_advbase <= 0 || > 255` -> EINVAL; OpenBSD likewise rejects <= 0.

## Reproduced (guest, stock kernel, ifconfig only)

```
# ifconfig carp0 vhid 1 pass pocpass advbase 1 advskew 0; ... up; (force MASTER)
# ifconfig carp0 advskew 100
# ifconfig carp0 advbase 0
carp: MASTER vhid 1 advbase 0 advskew 100        <- 0 accepted & stored
# 3 s of advertisements:
   14 -> 21 packets sent   (advbase 0, advskew 100: ~2.3 ads/s)
# ifconfig carp0 advskew 1
  21 -> 171 packets sent   (advbase 0, advskew 1: 50 ads/s = tick rate)
```

50 advertisements/second per carp(4) interface vs the protocol minimum
of 1/s (advbase>=1) — an L2/IGMP-state/CPU flood from one config line.
Trigger is privileged (root ifconfig), so severity: Low (validation
gap / foot-gun), but it also breaks the CARP protocol invariant
(RFC-style advbase >= 1s) that peer implementations rely on for
failover math.

## Fix

```diff
-		if (carpr->carpr_advbase > 255) {
+		if (carpr->carpr_advbase == 0 || carpr->carpr_advbase > 255) {
 			error = EINVAL;
 			goto back;
 		}
+		/* keep current advbase if caller passes 0 */
```
i.e. mirror FreeBSD:
```c
sc->sc_advbase = carpr->carpr_advbase ? carpr->carpr_advbase
                                      : CARP_DFLTINTV;
```

## Files

- run1.log / run2.log — guest console transcripts (ifconfig + netstat)