# DF-3371 -- verification pack

**Method:** Code-line analysis + attempted live reproduction
**Status:** NOT REPRODUCED | impact: none | confidence: likely

## What this is
IP_ADD_MEMBERSHIP with imr_address=INADDR_ANY does --rt->rt_refcnt then reads rt->rt_ifp (ip_output.c:1655-1659): a manual decrement + use-after-drop - if a concurrent RTM_DELETE freed the entry in between, both the decrement and the read touch freed memory. Stress attempted: ~370k joins raced against route(8) add/delete churn of 239.1/16 (and an in-process RTM socket writer; its RTM_DELETE formatting hit ESRCH, so the external route(8) churn carried the delete side). Window is 2 instructions - not hit; mechanism line-confirmed.

## Build
```
cc -O -o <prog> <prog>.c   (on the guest)
```

## Run
```
25 (root)
```
(success criterion: see VERDICT.md)

## Evidence
VERDICT.md run logs: joins=159670/173573/216187 across three runs, no crash

Kernel references: sys/netinet/ip_output.c:1655-1659