# DF-3347 -- verification pack

**Method:** Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
**Status:** REPRODUCED | impact: panic | confidence: certain

## What this is
lagg_lacp_attach ignores lacp_port_create failures; the poisoned port (lp_psc NULL) is dereferenced by every later LACP operation walking sc_ports. Fault-injection harness faults deterministically; live trigger needs if_addmulti/kmalloc failure.

## Build
```
./build.sh
```

## Run
```
df3347 poison
```
(success criterion: see VERDICT.md)

## Evidence
poison case rc=139; both-ports control rc=0; FIXED abort-on-failure clean

Kernel references: sys/net/lagg/if_lagg.c:2081-2082, sys/net/lagg/ieee8023ad_lacp.c:530-565