# DF-3353 — fs->backlogged not reset when pipe deletion purges child flowsets: p->sum accounting drift reaches 0 -> divide-by-zero panic (DF-3351 family in v3)

**File:** sys/net/dummynet3/ip_dummynet3.c (pass 2)
**Severity:** Medium (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) — CWE-682 Incorrect Calculation
**Verdict:** reproduced (panic) on stock INVARIANTS guest, see verdict.json.

## Build
copy `dfv3.c` + `setup.sh` to the guest, then (root):
    cc -O -o /tmp/dfv3 /tmp/dfv3.c

## Run
    sh /tmp/setup.sh      # kldloads ipfw3 (default-accept) + dummynet3, adds queue rules
    /tmp/dfv3 drift

## Expected
kernel panic signature in serial console (see panic.txt)

`setup.sh` sets `net.filters_default_to_accept=1` BEFORE `kldload ipfw3` —
ipfw3 otherwise boots default-deny and locks out ssh.

## Fix
`fix.diff` (union patch for DF-3352..DF-3356; the hunk for THIS finding is:
reset fs->backlogged=0 in dn_unref_pipe_cb before purging (fix.diff hunk 6)).