# DF-3354 — negative pipe bandwidth unvalidated -> NULL-deref write at ready_event_wfq TAILQ_LAST (delay=0) or t==0 wfq_ready_heap self-loop netisr wedge (DF-3350 family in v3)

**File:** sys/net/dummynet3/ip_dummynet3.c (pass 2)
**Severity:** Medium (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) — CWE-476 NULL Pointer Dereference
**Verdict:** reproduced (panic) on stock INVARIANTS guest, see verdict.json.

## Build
copy `dfv3.c` + `setup.sh` to the guest, then (root):
    cc -O -o /tmp/dfv3 /tmp/dfv3.c

## Run
    sh /tmp/setup.sh      # kldloads ipfw3 (default-accept) + dummynet3, adds queue rules
    /tmp/dfv3 negbw 0

## Expected
kernel panic signature in serial console (see panic.txt)

`setup.sh` sets `net.filters_default_to_accept=1` BEFORE `kldload ipfw3` —
ipfw3 otherwise boots default-deny and locks out ssh.

## Fix
`fix.diff` (union patch for DF-3352..DF-3356; the hunk for THIS finding is:
reject bandwidth<0 at config_pipe + NULL-guard the TAILQ_LAST write (fix.diff hunks 1-2)).