{
  "finding_id": "DF-3402",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "sloutput_serialized (if_sl.c:451-507) enqueues to sc->sc_fastq/ifsq holding only the ifsq hardware serializer (sloutput :516), while slstart (:529-713) dequeues the same queues holding only tty_token+t_token (called from sios siopoll under tty_token, sio.c:2241, or from sl_outfill). The two lock domains never intersect and ifqueue ops are non-atomic TAILQ manipulations, so concurrent enqueue/dequeue corrupts the queue -- lost mbufs, mbuf on two queues, m_nextpkt chains freed twice (objcache double-free/UAF) or dequeue walking freed chains. Root-gated SLIP setup + SMP interactive traffic; LEGACY bucket; memory-safety class but realistically a panic. Phase V skipped (legacy race, per batch instructions).",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-3402/README.md"
  ],
  "kernel_refs": [
    "sys/net/sl/if_sl.c:494",
    "sys/net/sl/if_sl.c:498",
    "sys/net/sl/if_sl.c:568",
    "sys/net/sl/if_sl.c:572",
    "sys/dev/serial/sio/sio.c:2241"
  ],
  "poc_changes": "n/a (Phase V skipped for this Low finding per batch contract)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "MPSAFE tag at :2 is wrong for the fastq; DF-0576..0579 covered callout/ioctl/BPF issues, not this queue-domain split",
  "recommended_fix": "Hold the tty token around fastq enqueue in sloutput_serialized (or a dedicated fastq lock) and run slstarts ifsq dequeue under the ifsq serializer"
}