{
 "finding_id": "DF-3300",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "dos",
 "confidence": "certain",
 "verdict": "Reproduced on the stock guest kernel with ifconfig only: SIOCSVH stores sc_advbase=0 whenever the same request carries advskew>0 (ip_carp.c:2463-2474 lacks the lower-bound check FreeBSD/OpenBSD have). With advbase=0/advskew=1 the carp(4) interface advertises at tick rate - measured 150 advertisements in 3 s (50/s) vs the protocol minimum of 1/s - and the BACKUP master-down timeout collapses to 3*0=0 s. Privileged trigger only (root ifconfig), hence Low severity, but it breaks the >=1 s CARP interval invariant for every peer.",
 "exploit_chain": "",
 "evidence": [
  "run2.log: carp: MASTER vhid 1 advbase 0 advskew 100 (0 accepted and stored)",
  "run2.log: packets sent 14->21 over 3 s at 0/100, then 21->171 over 3 s at 0/1 (50 ads/sec)",
  "sys/netinet/ip_carp.c:2463-2474 (missing advbase<=0 rejection)",
  "sys/netinet/ip_carp.c:1812,1839-1841 (tv_sec = advbase / 3*advbase)"
 ],
 "kernel_refs": [
  "sys/netinet/ip_carp.c:2463",
  "sys/netinet/ip_carp.c:1812",
  "sys/netinet/ip_carp.c:1839"
 ],
 "poc_changes": "No PoC source needed - plain ifconfig sequence: advskew 100 then advbase 0 (a bare advbase 0 with advskew==0 is skipped by the >0||>0 guard, so advskew must be non-zero in the stored state first), then advskew 1.",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 30,
 "guest_dirty": 1,
 "build_cmd": "(none - ifconfig only)",
 "run_cmd": "ifconfig carp0 advskew 100; ifconfig carp0 advbase 0; ifconfig carp0 | grep carp; netstat -s -p carp | grep packets sent; sleep 3; netstat -s -p carp | grep packets sent; ifconfig carp0 advskew 1; sleep 3; netstat -s -p carp | grep packets sent",
 "code_hash": "",
 "notes": "Measured on the stock (pre-fix) kernel during the DF-3298 session. 50 ads/s per carp interface; each ad is multicast to 224.0.0.18 and triggers gratuitous ARP on transitions. Fix mirrors FreeBSD: sc_advbase = carpr_advbase ? carpr_advbase : CARP_DFLTINTV (or reject <=0).",
 "recommended_fix": "Reject advbase==0 in carp_ioctl_setvh_dispatch (or substitute CARP_DFLTINTV for 0), matching FreeBSDs lower-bound validation."
}