# DF-3356 VERDICT — reproduced

## Root cause
set_fs_parms() clamps qsize only against the upper bound and 0 (ip_dummynet3.c:1442-1448: `qsize > 1024*1024` / `qsize == 0 || qsize > 100`); a negative qsize passes both checks (slot mode) and is stored. dummynet_io() then enforces the limit with `if (q->len >= fs->qsize)` (:1104) where q->len is u_int and the negative int is converted to ~4e9, so the drop check never fires and the flow queue grows without bound, pinning kernel memory (mbuf clusters) until the system exhausts memory. Demonstrated live on the stock guest with no panic: hammering 400 packets into a qsize=-1 flowset yields len=399, drops=0 in the IP_DUMMYNET_GET dump, while the byte-for-byte identical control run with qsize=50 yields len=50, drops=349. Growth is bounded only by available kernel memory. Identical code to v1 DF-0376; missed by pass-1 of this file.

## Exploit chain
root: setsockopt pipe{bw 8k} + fs{qsize=-1}; unprivileged UDP flood to a port diverted by an ipfw3 `queue` rule -> queue accumulates without limit -> kmalloc'd dn_pkt/mbuf exhaustion -> OOM DoS. No uid=0.

## Evidence
- run.log: GET dump qsize=-1 (len=399 drops=0) vs control qsize=50 (len=50 drops=349)
- dfv3.c: qsize subcommand + GET walker

## Kernel refs
- sys/net/dummynet3/ip_dummynet3.c:1442
- sys/net/dummynet3/ip_dummynet3.c:1446
- sys/net/dummynet3/ip_dummynet3.c:1100
- sys/net/dummynet3/ip_dummynet3.c:1104

## Fix validation
fix.diff hunk: clamp negative qsize to the defaults in set_fs_parms (fix.diff hunk 4). See verdict.json fix_* fields — a single guest
kernel rebuilt with the union fix.diff (all five findings) was re-tested with
the exact same PoCs: baseline panic/growth reproduced on the stock kernel,
patched kernel rejects or sanitizes the bad configs and shows none of the
five defects (details in fix section of verdict.json).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.