{
  "finding_id": "DF-3378",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ip6_mrouter_init() gates MRT6_INIT on m->m_len != sizeof(int *) (ip6_mroute.c:426); soopt_getm/soopt_to_mbuf set m_len = sopt_valsize, so the documented KAME API (int arg, 4 bytes) always fails ENOPROTOOPT on amd64 where sizeof(int*)=8. Deterministically verified on stock kernel #0: 4-byte -> errno 42, 8-byte -> rc=0. Consequence: no conforming daemon (pim6sd/pim6dd) can enable IPv6 multicast routing on 64-bit DragonFly; the subsystems entire attack surface is reachable only by custom 8-byte callers. Functional availability bug of a root-only feature - no memory-safety impact (impact=none for corruption purposes; availability/correctness defect). One-line fix (m->m_len < sizeof(int), matching FreeBSD) validated on rebuilt kernel #1: 4-byte MRT6_INIT returns rc=0.",
  "exploit_chain": "",
  "evidence": [
    "run.log (stock #0: 4-byte errno=42, 8-byte rc=0)",
    "fix_run.log (kernel #1: 4-byte rc=0; 8-byte EADDRINUSE because the first call now succeeds - correct)",
    "VERDICT.md"
  ],
  "kernel_refs": [
    "sys/netinet6/ip6_mroute.c:426",
    "sys/netinet6/ip6_mroute.c:429-430",
    "sys/kern/uipc_socket.c:2438-2469",
    "sys/netinet6/raw_ip6.c:496-499"
  ],
  "poc_changes": "Needed sys/param.h include for NBBY (ip6_mroute.h uses it); option level IPPROTO_IPV6 on the IPPROTO_ICMPV6 raw socket (rip6_ctloutput requires level IPPROTO_IPV6 for MRT6_*).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64 (baseline) / #1: Fri Sep 11 20:41:14 UTC 2026 (fix)",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -O -Wall -o /tmp/df3378 /root/poc/trigger_mrt6_init.c",
  "run_cmd": "/tmp/df3378",
  "code_hash": "370db1d3ede85b7424e32f3b2cb879e66678691c9900436f14174878bf817427",
  "notes": "Also acts as a triage gate: proves all other ip6_mroute.c attack-surface findings (DF-0423/24/26 family) are unreachable via stock daemons on amd64, while custom 8-byte callers still reach them (and DF-3377s harness does exactly that).",
  "recommended_fix": "Change the length gate to m->m_len < sizeof(int) (accept the 4-byte KAME API arg; ideally port the v4 files sopt_to_kbuf pattern to all MRT6_* handlers).",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly 6.5-DEVELOPMENT #1: Fri Sep 11 20:41:14 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "One-line fix validated on the same rebuilt kernel as DF-3377: MRT6_INIT(4-byte int) now returns rc=0; the follow-on 8-byte call correctly returns EADDRINUSE because the first call now claims ip6_mrouter.",
  "fix_evidence": "fix_run.log"
}