# DF-3301 -- verification pack

**Method:** Live PoC on the QEMU guest (stock INVARIANTS kernel)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
CARP HMAC key = raw zero-padded ASCII passphrase, no KDF anywhere: four captured advertisements (vhid 1, pass test123) ALL authenticate under HMAC-SHA1 with key b"test123"+13x00 (construction recomputed independently from carp_hmac_prepare/generate). A user choosing a weak passphrase gets exactly its low-entropy bytes as a 20-byte HMAC key.

## Build
```
cc -O -o <prog> <prog>.c   (on the guest)
```

## Run
```
(driver: ifconfig carp0 ... pass test123 + tcpdump)
```
(success criterion: see VERDICT.md)

## Evidence
carp_verify.txt (fresh capture): 4/4 packets match HMAC(zero-padded ASCII); live4.log tcpdump lines

Kernel references: sys/netinet/ip_carp.c:2476-2538, sys/netinet/ip_carp.c:504-554, sys/netinet/ip_carp.c:556-575