{
  "finding_id": "DF-3345",
  "manifest_version": 1,
  "title": "lagg_lacp_detach drops the lagg WLock mid-detach while sc_* protocol callbacks are still installed: ioctl re-entry (incl. unprivileged SIOCGLAGG) into half-torn-down LACP state",
  "verdict": "not_reproduced",
  "impact": "none",
  "reproduce": {
    "build": "cc -O2 -o /tmp/laggspin laggspin.c -I/usr/src/sys",
    "run": "./run.sh (6 unprivileged SIOCGLAGG spinners vs 1500 privileged laggproto lacp<->failover flips)",
    "expected": "structural analysis predicts a NULL-deref panic (lacp_req on sc_psc==NULL) if an SIOCGLAGG lands in the detach window; NOT manifested in 1800 flips on the guest"
  },
  "kernel_refs": [
    "sys/net/lagg/if_lagg.c:1085",
    "sys/net/lagg/if_lagg.c:1090",
    "sys/net/lagg/if_lagg.c:2101",
    "sys/net/lagg/if_lagg.c:2103",
    "sys/net/lagg/ieee8023ad_lacp.c:848",
    "sys/net/lagg/ieee8023ad_lacp.c:607",
    "sys/net/lagg/ieee8023ad_lacp.c:561",
    "sys/net/lagg/if_lagg.c:707",
    "sys/net/lagg/if_lagg.c:427"
  ],
  "artifacts": [
    "laggspin.c", "VERDICT.md", "build.sh", "run.sh", "run.log",
    "manifest.json", "verdict.json"
  ]
}