{
  "finding_id": "DF-3383",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "bpfdetach() breaks at the FIRST bpf_if matching the ifnet and frees only that one, but a wlan vap carries a second entry (DLT_IEEE802_11_RADIO registered by ieee80211_radiotap_vattach via bpfattach_dlt on the same ifp, with ieee80211_radiotap_vdetach an empty no-op). The surviving entry keeps bif_ifp/bif_driverp pointing at the ifnet that if_detach() frees: later bpfclose()->bpf_detachd() writes *bp->bif_driverp=NULL into freed memory and calls ifpromisc() on the freed ifnet (UAF), BIOCGETIF leaks freed-memory contents, and address reuse can alias a new interface with the wrong DLT. Additionally the not attached path dereferences bp==NULL (bpf.c:1574) instead of printing the intended message. Not reproduced on this guest: creating the trigger requires an 802.11 vap and the QEMU guest has no wifi parent (ifconfig wlan0 create wlandev ath0 -> SIOCIFCREATE2: Device not configured; wlan.ko loads fine). Defect is certain from code reading; trigger hardware absent - classified not_reproduced, not false-positive.",
  "exploit_chain": "",
  "evidence": [
    "attempt.log: kldload wlan ok; ifconfig wlan0 create wlandev ath0 -> SIOCIFCREATE2: Device not configured; ifconfig -l shows vtnet0 lo0 only",
    "README.md: full code-path citation of the leftover-bpf_if UAF"
  ],
  "kernel_refs": [
    "sys/net/bpf.c:1566-1590",
    "sys/net/bpf.c:113-126",
    "sys/net/bpf.c:306-348",
    "sys/netproto/802_11/wlan/ieee80211_radiotap.c:126-141",
    "sys/net/if_ethersubr.c:655-673"
  ],
  "poc_changes": "Probe only; the multi-bpf_if precondition cannot be constructed without an 802.11 parent device.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o probe probe.c",
  "run_cmd": "kldload wlan; ifconfig wlan0 create wlandev ath0",
  "code_hash": "ac7da99167605f593d13c7d9457d26bc4cd698f2dfb2f92b52cba7af81ecda0d",
  "notes": "Requires root (ifconfig create/destroy) plus wifi hardware. Suggested fix: bpfdetach must iterate ALL matching bpf_if entries (detach each dlist, unlink and free each) and null-check bp before deref.",
  "recommended_fix": "Loop bpfdetach over every bpf_if whose bif_ifp matches; check bp==NULL before bp->bif_ifp.",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline never reproduced (trigger requires 802.11 hardware absent from guest); fix not carried in the validated diff - suggested loop-over-all-matching-bpf_if patch in README.md.",
  "fix_evidence": [
    "attempt.log"
  ]
}