{
 "finding_id": "DF-3308",
 "status": "reproduced",
 "reproduced": 1,
 "poc_path": "findings/poc/DF-3308",
 "artifact_dir": "findings/poc/DF-3308",
 "build_cmd": "cc -O -o <prog> <prog>.c   (on the guest)",
 "run_cmd": "(no arg; root)",
 "code_hash": "8222d8b793368d26302b8fd0cf0ce7a2188d3309290b90bc18855abe63c3558b",
 "build_log": "(inline)",
 "run_log": "live2.log",
 "impact": "none",
 "confidence": "certain",
 "verdict": "IPV6_MULTICAST_IF stores an unreferenced ifnet pointer in in6p_moptions (ip6_output.c:2253) and the interface-detach purge runs only for rip+udp (in6_ifattach.c:818-819) - TCP6 pcbs keep a DANGLING im6o_multicast_ifp. Live: TCP6 socket cached tap0 (index 3); after ifconfig tap0 destroy, getsockopt(IPV6_MULTICAST_IF) still dereferenced the freed ifnet and returned 3 (ip6_output.c:2499 reads im6o->im6o_multicast_ifp->if_index). Memory was not recycled in this run, so no garbage/crash - a 1-int stale read; impact limited.",
 "exploit_chain": "",
 "evidence": "live2.log DF-3308 section: before destroy: index 3; after destroy: returns 3 (deref of freed ifnet)",
 "kernel_refs": [
  "sys/netinet6/ip6_output.c:2253",
  "sys/netinet6/ip6_output.c:2493-2499",
  "sys/netinet6/in6_ifattach.c:818-819",
  "sys/netinet6/in6_pcb.c:688-756"
 ],
 "poc_changes": "",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "notes": "",
 "recommended_fix": "fix.diff",
 "fix_status": "fixed",
 "fix_verdict": "A/B on the combined-fix kernel (kernel #1 17:38, in6_ifattach.c purge extended to tcbinfo): baseline stock kernel returned the stale index 3 after tap0 destroy (freed-ifnet deref); patched kernel returns 0 (im6o_multicast_ifp purged). See fixkernel.log / fix_run.log.",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_kernel_uname": "DFBSD 6.5-DEVELOPMENT combined-fix kernel (see fixkernel.log)"
}