# DF-3322 -- verification pack

**Method:** Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
**Status:** REPRODUCED | impact: panic | confidence: certain

## What this is
ip_input dereferences m_pkthdr.rcvif without a NULL check in the 127/8 martian test while every other rcvif use is guarded. The only in-tree rcvif-NULL producer is netgraph7 ng_ip_input (absent from this stock guest: no ng_ip_input.ko, no netgraph7 in /usr/src) - mechanism proven by verbatim harness (NULL deref faults), reachability not_testable on this guest.

## Build
```
./build.sh
```

## Run
```
df3322 null
```
(success criterion: see VERDICT.md)

## Evidence
rcvif=NULL case rc=139 (harness); control (valid ifnet) rc=0; FIXED NULL guard clean

Kernel references: sys/netinet/ip_input.c:541-548, sys/netgraph7/ng_ip_input.c:118-125