# DF-3330 -- verification pack

**Method:** Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
hwmp_send_action takes TWO iv_bss references for broadcast HWMP frames (hwmp.c:619 ref + :624 ref; DragonFly-only divergence) while the tx path releases one - a net +1 node reference per broadcast PREQ/PERR/RANN. Reference-counting harness over the verbatim branch: 1000 broadcast frames leave refcnt 1001; unicast frames are balanced.

## Build
```
./build.sh
```

## Run
```
(no arg)
```
(success criterion: see VERDICT.md)

## Evidence
misc3.log DF-3330: refcnt 1 -> 1001 after 1000 broadcast frames; unchanged after 1000 unicast frames

Kernel references: sys/netproto/802_11/wlan/ieee80211_hwmp.c:616-624