# DF-3346 -- verification pack

**Method:** Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
**Status:** REPRODUCED | impact: panic | confidence: certain

## What this is
SIOCSLAGG publishes sc_proto before ti_attach; a failed attach (lacp_attach kmalloc M_NOWAIT failure) leaves sc_proto=LACP with NULL sc_psc, and the NEXT SIOCSLAGG NULL-derefs in lacp_port_destroy. Live trigger needs memory pressure; fault-injection harness (verbatim ordering) faults deterministically.

## Build
```
./build.sh
```

## Run
```
df3346 poison
```
(success criterion: see VERDICT.md)

## Evidence
poison case rc=139 (NULL deref); balanced control rc=0; FIXED publish-after-attach + rollback clean

Kernel references: sys/net/lagg/if_lagg.c:1086-1117, sys/net/lagg/ieee8023ad_lacp.c:795-804