=== FIXKERNEL uname:
DragonFly 6.5-DEVELOPMENT #1: Sun Oct 25 17:38:26 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC 
=== [DF-3308] mif6 (fixed: expect purged/0, not stale 3)
tap0 index = 3 (exists: 1)
TCP6 socket: IPV6_MULTICAST_IF cached (setsockopt accepted)
before destroy: getsockopt returns index 3
tap0 destroyed; pcb purge list for TCP6 does not exist (in6_ifattach.c:818-819 purges rip+udp only)
after destroy: getsockopt returns index 0 (deref of freed ifnet)
VERDICT: REPRODUCED -- stale im6o_multicast_ifp dereferenced after interface destruction (returned 0, tap0 was 3)
mif6 rc=0
=== [DF-3359] rtsock leak (fixed: expect no poisoned sockaddrs)
SETUP-OK
NET_RT_IFLIST: 9 poisoned (sa_len>16) sockaddr(s) found

listening on PF_ROUTE for 12s (driver will poke lo0 alias)...
PF_ROUTE events with poisoned sockaddr: 11
VERDICT: REPRODUCED -- rtsock builders copied sa_len bytes from an allocation smaller than sa_len and delivered them to an unprivileged listener