{
 "finding_id": "DF-3409",
 "status": "not_reproduced",
 "reproduced": 0,
 "poc_path": "findings/poc/DF-3409",
 "artifact_dir": "findings/poc/DF-3409",
 "build_cmd": "cc -O -o <prog> <prog>.c   (on the guest)",
 "run_cmd": "(none)",
 "code_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
 "build_log": "(inline)",
 "run_log": "VERDICT.md",
 "impact": "none",
 "confidence": "certain",
 "verdict": "tuncreate publishes dev->si_drv1 = sc BEFORE if_alloc and never rolls back on failure (if_tun.c:213-242) - the half-built softc would later NULL-deref in tunifioctl (sc->tun_ifp == NULL). However the trigger is unreachable in practice: if_alloc(IFT_PPP) is a plain M_WAITOK kmalloc with no com_alloc hook (if.c if_alloc), so it cannot fail short of a sleeping allocation failure the kernel does not surface. Mechanism line-confirmed; no live/harness trigger.",
 "exploit_chain": "",
 "evidence": "VERDICT.md: if_alloc excerpt (M_WAITOK, IFT_PPP has no com_alloc) - failure path unreachable",
 "kernel_refs": [
  "sys/net/tun/if_tun.c:213-242",
  "sys/net/if.c:if_alloc"
 ],
 "poc_changes": "",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "notes": "",
 "recommended_fix": "",
 "fix_status": "not_testable",
 "fix_verdict": "Fix: on if_alloc failure, kfree(sc) and clear dev->si_drv1 before returning NULL; trigger unreachable, no A/B possible.",
 "fix_baseline_reproduced": null,
 "fix_patched_reproduced": null
}