{
  "finding_id": "DF-3400",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "nat_del_dispatch (ip_fw3_nat.c:785-850) frees only the RB-tree nat_states; the loops meant to free per-alias nat_state2 entries are commented out (:806-842), so every tcp_in/udp_in/icmp_in state (one per flow per direction, up to 3x64511 per alias) leaks on ipfw3 nat N delete/flush/module unload. The cleanup callout frees expired s2 only while the NAT exists (:948-996), so deleting first strands them. Additionally :326s icmp_in store overwrites a colliding s2 without freeing. Root-gated config-churn heap leak, unbounded with add/delete cycles. Certain from code; Phase V skipped (Low, per batch contract).",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-3400/README.md"
  ],
  "kernel_refs": [
    "sys/net/ipfw3_nat/ip_fw3_nat.c:806",
    "sys/net/ipfw3_nat/ip_fw3_nat.c:843",
    "sys/net/ipfw3_nat/ip_fw3_nat.c:326"
  ],
  "poc_changes": "n/a (Phase V skipped for this Low finding per batch contract)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Low severity root-churn leak; no PoC run per batch instructions",
  "recommended_fix": "Uncomment/rewrite the s2 free loops in nat_del_dispatch to walk alias->{tcp,udp,icmp}_in[] and kfree non-NULL entries before freeing the alias; free displaced s2 on icmp_in overwrite"
}