# DF-3411 -- verification pack

**Method:** Code-line analysis + attempted live reproduction
**Status:** NOT REPRODUCED | impact: none | confidence: likely

## What this is
funsetown (kern_descrip.c:1239-1273) drops sigio_token BEFORE the list removal/crfree/kfree while pgsigio (kern_sig.c:2639) derefs the sigio with no token: tunifstart's pgsigio(sc->tun_sigio) racing a concurrent FIOSETOWN is a genuine use-after-free window. Stress attempted live (FIOSETOWN hammer + continuous tun0 traffic driving tunifstart): ~55s combined, no crash; window is a handful of instructions. Mechanism line-confirmed.

## Build
```
cc -O -o <prog> <prog>.c   (on the guest)
```

## Run
```
20 (root)
```
(success criterion: see VERDICT.md)

## Evidence
VERDICT.md run log: FIOSETOWN storm + ping/UDP traffic through tun0, rc=124 (alive, no crash)

Kernel references: sys/net/tun/if_tun.c:533-536, sys/kern/kern_descrip.c:1239-1273, sys/kern/kern_sig.c:2639-2663