{
 "finding_id": "DF-3395",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "dos",
 "confidence": "certain",
 "verdict": "Reproduced deterministically on the stock guest: ifconfig vtnet0 name vtnet0r (SIOCSIFNAME) fires ifnet_detach_event (if.c:2206); vlans handler (correctly registered on that event, if_vlan.c:377) unconfigures every vlan on the renamed parent (if_vlan.c:410-429 -> vlan_unconfig), permanently destroying the parent+tag L2 configuration (vlan: 0 parent interface: <none>); renaming back does not restore it. All tagged subnets on the renamed interface blackhole until reconfigured. Privileged trigger, memory-safe teardown -> Low.",
 "exploit_chain": "",
 "evidence": [
  "run.log \u2014 before: vlan: 100 parent interface: vtnet0 / status: active; after rename: vlan: 0 parent interface: <none>; after rename-back: still <none>",
  "VERDICT.md \u2014 event chain if.c:2206 -> if_vlan.c:432 -> if_vlan.c:410-429 -> vlan_unconfig (if_vlan.c:854)"
 ],
 "kernel_refs": [
  "sys/net/if.c:2206",
  "sys/net/vlan/if_vlan.c:377",
  "sys/net/vlan/if_vlan.c:432",
  "sys/net/vlan/if_vlan.c:410",
  "sys/net/vlan/if_vlan.c:854"
 ],
 "poc_changes": "Seed sketch converted to a self-contained shell script (rename_wipes_vlan.sh) with setup/verify/restore phases.",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 25,
 "guest_dirty": 1,
 "build_cmd": "sh rename_wipes_vlan.sh",
 "run_cmd": "sh rename_wipes_vlan.sh",
 "code_hash": "e4c0616d36e97820ee7573440cada98ba31223298e0065dec6943019671aab38",
 "notes": "Same event-abuse collateral applies to other ifnet_detach_event subscribers (bridge member removal on rename). Cross-ref DF-3344 (lagg registered on the never-fired ifnet_departure_event \u2014 the inverse mistake).",
 "recommended_fix": "Fire announcement-only ifnet_departure_event in the SIOCSIFNAME path instead of ifnet_detach_event (keep the latter for real destruction in if_detach()).",
 "fix_status": "not_testable",
 "fix_kernel_uname": "",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "fix.diff authored (one-line event swap + rationale) but kernel rebuild not performed in this run (non-memory-corruption, Low severity; validation deferred).",
 "fix_evidence": "fix.diff"
}