# DF-3348 -- verification pack

**Method:** Code-line analysis + attempted live reproduction
**Status:** NOT REPRODUCED | impact: none | confidence: likely

## What this is
lagg_sysctl_active walks sc_ports with no LAGG lock (if_lagg.c:1620-1638) and lagg_port_destroy swaps if_ioctl/if_output/if_lagg without the port serializer. Race attempted live: 4000 sysctl walks against 300 port add/remove cycles - no crash (the freed lp is slab-contained and the window needs packet traffic in flight during teardown). Mechanism line-confirmed.

## Build
```
cc -O -o <prog> <prog>.c   (on the guest)
```

## Run
```
(driver script)
```
(success criterion: see VERDICT.md)

## Evidence
run log in VERDICT.md (lagg_race.sh: sysctl=net.link.lagg.0.active, 4000 walks, no crash)

Kernel references: sys/net/lagg/if_lagg.c:1620-1638, sys/net/lagg/if_lagg.c:755-775