# DF-3409 -- verification pack

**Method:** Code-line analysis + attempted live reproduction
**Status:** NOT REPRODUCED | impact: none | confidence: certain

## What this is
tuncreate publishes dev->si_drv1 = sc BEFORE if_alloc and never rolls back on failure (if_tun.c:213-242) - the half-built softc would later NULL-deref in tunifioctl (sc->tun_ifp == NULL). However the trigger is unreachable in practice: if_alloc(IFT_PPP) is a plain M_WAITOK kmalloc with no com_alloc hook (if.c if_alloc), so it cannot fail short of a sleeping allocation failure the kernel does not surface. Mechanism line-confirmed; no live/harness trigger.

## Build
```
cc -O -o <prog> <prog>.c   (on the guest)
```

## Run
```
(none)
```
(success criterion: see VERDICT.md)

## Evidence
VERDICT.md: if_alloc excerpt (M_WAITOK, IFT_PPP has no com_alloc) - failure path unreachable

Kernel references: sys/net/tun/if_tun.c:213-242, sys/net/if.c:if_alloc