# DF-3414 -- verification pack

**Method:** Live PoC on the QEMU guest (stock INVARIANTS kernel)
**Status:** REPRODUCED | impact: panic | confidence: certain

## What this is
if_clone_destroy drops the ifnet lock between ifunit() lookup and teardown: two concurrent SIOCIFDESTROY destroyers both pass the lookup and double-run if_clone_free_unit + ifc->ifc_destroy. Reproduced TWICE on this guest with a dedicated destroyer-vs-destroyor race (no tun cdev involvement): panic 'if_clone_free_unit: bit is already cleared', trace if_clone_destroy <- ifioctl <- syscall2. On non-INVARIANTS kernels the same interleaving is a double bit-clear plus ifc->ifc_destroy on a freed ifnet (UAF).

## Build
```
cc -O -o <prog> <prog>.c   (on the guest)
```

## Run
```
60 (root)
```
(success criterion: see VERDICT.md)

## Evidence
panic.txt + panic.2.txt (two independent panics, full traces); race_clone.c

Kernel references: sys/net/if_clone.c:104-135, sys/net/if_clone.c:if_clone_free_unit