# DF-3378 VERDICT — REPRODUCED (deterministic; MRT6_INIT gate uses sizeof(int*) so IPv6 multicast routing cannot be enabled by conforming daemons on amd64)

## Bottom line
`ip6_mrouter_init()` gates MRT6_INIT on `m->m_len != sizeof(int *)`
(sys/netinet6/ip6_mroute.c:426). `m` comes from `soopt_getm()` /
`soopt_to_mbuf()` (sys/kern/uipc_socket.c:2438-2492), which sets
`m->m_len = sopt_valsize`. The documented KAME/pim6sd API passes a 4-byte
`int` — on amd64 `sizeof(int *) == 8` so every conforming daemon gets
**ENOPROTOOPT** and IPv6 multicast routing cannot be enabled at all. Only a
caller passing 8 bytes (first int = 1) initializes the subsystem. Verified
deterministically on the guest stock kernel #0 and after the one-line fix on
kernel #1. Functional availability bug of a root-only subsystem (no memory
safety impact); also a reachability gate for every other path in the file
(stock daemons never reach them; custom 8-byte callers do).

## Reproduction (stock kernel #0, root)
```
$ cc -O -Wall -o /tmp/df3378 trigger_mrt6_init.c && /tmp/df3378
MRT6_INIT(4-byte int arg): rc=-1 errno=42 (Protocol not available)   <- bug
MRT6_INIT(8-byte arg):     rc=0  errno=0 (Success)
```
(run.log). errno 42 = ENOPROTOOPT exactly at ip6_mroute.c:426-427.

## Fix validation (kernel #1)
`m->m_len != sizeof(int *)` → `m->m_len < sizeof(int)` (fix.diff; same
line FreeBSD uses). On kernel #1:
```
MRT6_INIT(4-byte int arg): rc=0 errno=0 (Success)          <- fixed
MRT6_INIT(8-byte arg):     rc=-1 errno=48 (Address already in use)
```
(fix_run.log). The second line's EADDRINUSE is correct behavior: the first
call now succeeds and claims ip6_mrouter, so the second INIT is refused —
proof the gate opened. fix_status=fixed.

## Severity rationale
Low: requires root (raw ICMPv6 socket) to even call; impact is "feature
unusable / wrong errno", no crash, no leak, no bypass. Triage value is
high though: it proves all mroute6 attack-surface findings (incl. DF-0423)
are unreachable via stock daemons on amd64, while custom callers (or a
fixed kernel) reach them.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.