{
 "finding_id": "DF-3302",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "likely",
 "verdict": "add_mfc() uses the result of an unlocked mfc_find() (ip_mroute.c:976) - token only taken at :986 for update_mfc_params() (:987-988), racing del_mfcs unlink+kfree (:1108-1117) -> write into freed memory. 100s hammer with 512 colliding (S,G) pairs (lengthened mfc_find walks) on two threads: no INVARIANTS trip, no panic - the window between lookup-return and token acquisition is nanoseconds and objcache kfree does not poison. Race is real by inspection; manifestation not landed. Both operations root-only => Low.",
 "exploit_chain": "",
 "evidence": [
  "run.log: crafted 512 (S,G) pairs colliding into bucket 54, survived 100 seconds"
 ],
 "kernel_refs": [
  "sys/net/ip_mroute/ip_mroute.c:976",
  "sys/net/ip_mroute/ip_mroute.c:986",
  "sys/net/ip_mroute/ip_mroute.c:987",
  "sys/net/ip_mroute/ip_mroute.c:1108",
  "sys/net/ip_mroute/ip_mroute.c:1117"
 ],
 "poc_changes": "None vs seed (self-authored); widened window with hash-colliding pairs.",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Sep 10 09:22:03 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/PIMTEST x86_64",
 "runtime_sec": 120,
 "guest_dirty": 1,
 "build_cmd": "cc -O2 -Wall -pthread -o mfcrace mfcrace.c",
 "run_cmd": "./mfcrace 100",
 "code_hash": "abceb6768a79b5d84380def02b83a107c97979f013fce024240f81892d9ce0ab",
 "notes": "Same class as DF-0306 (pointer held across token release). Fix trivially correct by inspection; patched kernel built/booted.",
 "recommended_fix": "Take mroute_token before mfc_find() in add_mfc() and hold it through the update/insert paths.",
 "fix_status": "inconclusive",
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Thu Sep 10 10:33:47 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/PIMTEST x86_64",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "Fix (token across lookup+update) included in fix.diff; patched kernel built and boots; race itself never reproduced so no differential crash test possible.",
 "fix_evidence": "fix_build.log"
}