# DF-3393 -- verification pack

**Method:** Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
rn_match exact-compare loop is bounded only by the caller clen(key): an unprivileged RTM_GET with dst sa_len=255 reads up to 239 bytes past the stored 16-byte v4 host-route key. Verbatim rn_match/rn_search/rn_satisfies_leaf harness faults the guard page; the same harness also demonstrates the impact ceiling - the MIN-length discipline in rn_satisfies_leaf masks any equality oracle (mismatch at byte 20 still returns the leaf).

## Build
```
./build.sh
```

## Run
```
df3393 oob
```
(success criterion: see VERDICT.md)

## Evidence
caller clen=255 vs 16-byte stored key rc=139 (guard); control (padded alloc) rc=0; FIXED stored-key clamp clean

Kernel references: sys/net/radix.c:306-329, sys/net/route.c, sys/net/rtsock.c:780-790