# DF-3308 -- verification pack

**Method:** Live PoC on the QEMU guest (stock INVARIANTS kernel)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
IPV6_MULTICAST_IF stores an unreferenced ifnet pointer in in6p_moptions (ip6_output.c:2253) and the interface-detach purge runs only for rip+udp (in6_ifattach.c:818-819) - TCP6 pcbs keep a DANGLING im6o_multicast_ifp. Live: TCP6 socket cached tap0 (index 3); after ifconfig tap0 destroy, getsockopt(IPV6_MULTICAST_IF) still dereferenced the freed ifnet and returned 3 (ip6_output.c:2499 reads im6o->im6o_multicast_ifp->if_index). Memory was not recycled in this run, so no garbage/crash - a 1-int stale read; impact limited.

## Build
```
cc -O -o <prog> <prog>.c   (on the guest)
```

## Run
```
(no arg; root)
```
(success criterion: see VERDICT.md)

## Evidence
live2.log DF-3308 section: before destroy: index 3; after destroy: returns 3 (deref of freed ifnet)

Kernel references: sys/netinet6/ip6_output.c:2253, sys/netinet6/ip6_output.c:2493-2499, sys/netinet6/in6_ifattach.c:818-819, sys/netinet6/in6_pcb.c:688-756