{
 "finding_id": "DF-3306",
 "status": "untested",
 "reproduced": 0,
 "impact": "none",
 "confidence": "speculative",
 "verdict": "Latent UAF: expire_upcalls() (:1423-1428) kfrees bw meters without unschedule_bw_meter() (FreeBSD calls it), so a scheduled meter freed there would stay linked in bw_meter_timers[] -> UAF at the next 1 Hz pass. Unreachable today: meters only attach to non-stalled entries (mfc_find :327-332 skips stalled), expire_upcalls only frees stalled entries (:1400) which are created with mfc_bw_meter=NULL (:1337). Info-level hardening; one-line fix included in fix.diff, patched kernel builds and boots.",
 "exploit_chain": "",
 "evidence": [
  "README.md (reachability proof)",
  "VERDICT.md"
 ],
 "kernel_refs": [
  "sys/net/ip_mroute/ip_mroute.c:1423",
  "sys/net/ip_mroute/ip_mroute.c:1427",
  "sys/net/ip_mroute/ip_mroute.c:327",
  "sys/net/ip_mroute/ip_mroute.c:1400",
  "sys/net/ip_mroute/ip_mroute.c:1337"
 ],
 "poc_changes": "",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Sep 10 09:22:03 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/PIMTEST x86_64",
 "runtime_sec": 0,
 "guest_dirty": 1,
 "build_cmd": "",
 "run_cmd": "",
 "code_hash": "",
 "notes": "No PoC possible: the precondition (scheduled meter on a stalled mfc) cannot be constructed through any existing path. [orchestrator: status normalized from not_testable to untested for persist_poc vocabulary - latent finding, no PoP possible]",
 "recommended_fix": "unschedule_bw_meter(x) before kfree(x, M_BWMETER) in expire_upcalls(), matching FreeBSD.",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Thu Sep 10 10:33:47 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/PIMTEST x86_64",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "One-line unschedule added; kernel with the fix builds and boots (no runtime test possible - code path unreachable by construction).",
 "fix_evidence": "fix_build.log"
}