{
  "finding_id": "DF-3311",
  "title": "wg_down()/wg_clone_destroy() race in-flight receive upcall: handshake/decrypt tasks and queues re-enqueued after cancel, used after free",
  "verdict": "inconclusive",
  "impact": "dos",
  "confidence": "likely (code defect certain; one fatal manifestation, not repeatable in 4 retries)",
  "reproduce": {
    "build": "cd findings/poc/DF-3311 && sh build.sh   (in-guest; cc 8.3)",
    "run": "sh run.sh  (root churn as shown + 'su -m nobody -c ./spam 127.0.0.1 51820 0 tag'); repeat whole cycle on failure",
    "expected": "guest dies silently: ssh times out, vm.sh status => down, no reboot/panic text in serial log, no /var/crash dump; observed once at <=45 s into run #1"
  },
  "kernel_refs": [
    "sys/net/wg/if_wg.c:2163",
    "sys/net/wg/if_wg.c:2170",
    "sys/net/wg/if_wg.c:2189",
    "sys/net/wg/if_wg.c:2763",
    "sys/net/wg/if_wg.c:2795",
    "sys/net/wg/if_wg.c:2883",
    "sys/net/wg/if_wg.c:2885",
    "sys/net/wg/if_wg.c:2917"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "wgtool.c", "spam.c", "raceA.sh",
    "raceA12.sh", "raceB2.sh", "build.sh", "run.sh", "run.log",
    "run.2.log", "run.3.log", "env.txt", "fix.diff", "manifest.json",
    "verdict.json"
  ]
}