# DF-3410 -- verification pack

**Method:** Live PoC on the QEMU guest (stock INVARIANTS kernel)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
TUNSIFMODE validates *(int*)data & ~IFF_MULTICAST but ORs the RAW word into if_flags: the IFF_MULTICAST bit rides along outside the validated mode set (demonstrated live: raw word IFF_BROADCAST|IFF_MULTICAST accepted and MULTICAST kept set). Honest impact ceiling: the mask admits only the MULTICAST bit as extra, and tun(4) is created with IFF_MULTICAST already set (and it is in IFF_CANTCHANGE), so no stock configuration delta exists.

## Build
```
cc -O -o <prog> <prog>.c   (on the guest)
```

## Run
```
(no arg; root)
```
(success criterion: see VERDICT.md)

## Evidence
live1.log DF-3410 section: flags before 0x8010 [PTP MCAST], after TUNSIFMODE(BCAST) 0x8002 [BCAST MCAST], raw word accepted, BCAST|0x100 correctly EINVALs

Kernel references: sys/net/tun/if_tun.c:731-738, sys/net/if.h:119-124