{
  "finding_id": "DF-3351",
  "status": "untested",
  "reproduced": 0,
  "impact": "panic",
  "confidence": "likely",
  "verdict": "Not guest-verified (Low severity, panic-only class, root-gated config surface identical to the already-filed DF-0374/0375 div0 family). Static analysis is line-accurate: dn_unref_pipe_cb() purges child flowset queues at pipe delete without resetting fs->backlogged, and delete_pipe():1694 subtracts fs->weight*fs->backlogged from p->sum while the fss idle-heap flows weights are never subtracted, so p->sum drifts by weight*(stale-idle) per fs-delete and can be steered to exactly 0 with a live flow in scheduler_heap, making ready_event_wfq():555 p->V += (len << MY_M) / p->sum a divide-by-zero panic.",
  "exploit_chain": "",
  "evidence": [
    "README.md: full accounting-drift derivation with construction sketch and proposed fix"
  ],
  "kernel_refs": [
    "sys/net/dummynet/ip_dummynet.c:555",
    "sys/net/dummynet/ip_dummynet.c:1189-1239",
    "sys/net/dummynet/ip_dummynet.c:1627-1638",
    "sys/net/dummynet/ip_dummynet.c:1694-1699"
  ],
  "poc_changes": "n/a (no PoC authored; analysis-only)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Verification skipped per contract (Low severity, panic-only). The trigger construction requires precise interleaving of pipe delete/recreate and fs delete; DF-3350s negative-bandwidth finding was prioritized for the guest budget.",
  "recommended_fix": "Reset fs->backlogged when dn_unref_pipe_cb purges the flowset at pipe delete, and subtract the weights of the fss idle-heap flows in the delete_pipe fs path."
}