# DF-3424 VERDICT

**Status: REPRODUCED** (deterministic, 1 attempt, <1 s from sysctl to panic)

## What was run

`./build.sh && ./run.sh` on the QEMU guest (DragonFly 6.5-DEVELOPMENT #0,
stock INVARIANTS kernel, net.netisr.ncpus=6):

1. `sysctl net.inet.ip.portrange.first=1032` / `last=1032` (root).
2. Trigger executed as unprivileged user `maxx`: 12 threads spinning
   AF_INET6/UDP `bind(::, port 0)`.

## Observation

Guest panicked immediately; serial console (panic.txt):

```
Fatal trap 18: integer divide fault while in kernel mode
cpuid = 0; lapic id = 0
...
Stopped at      in6_pcbsetlport+0x126:  divl    %esi,%eax
```

## Why (line-by-line)

- `sys/netinet6/in6_src.c:472` — `in_pcbportrange(&last, &first, ofs, step)`
  with step=6: with first==last==1032 and ofs==0 (CPU0's portinfo stratum):
  hi=rounddown(1032,6)+0=1032 (<=1032, kept); lo=roundup(1032,6)-(6-0)=1026,
  1026<1024? no wait 1026<1032 -> lo += 6 -> 1032. => first=last=1032.
- `in6_src.c:473` — `lport = last - first` = **0**.
- `in6_src.c:474` — `count = lport / step` = 0 (0/6, no trap).
- `in6_src.c:476` — `rounddown(cut % lport, step) + first` = `cut % 0`
  => x86 #DE => Fatal trap 18 => panic. Symbolized stop confirms
  `in6_pcbsetlport+0x126: divl %esi,%eax`.

`cpuid = 0` matches the prediction: the div0 fires only on the portinfo
stratum with offset==0; other CPUs wrap the range (first>last, lport=65530)
and bind an out-of-range port harmlessly. The parallel bind loop lands on
CPU0 within milliseconds.

## Exploitability

DoS only: integer divide fault is a trap, not a corruption primitive; there
is no route from `cut % 0` to controlled write. Impact ceiling: after a
root misconfiguration of the shared v4/v6 port-range sysctls, ANY local
user's IPv6 (and v4, per DF-0334's sites) ephemeral port allocation panics
the system — repeatable at will until the sysctl is reverted.

## Relation to DF-0334

DF-0334 owns the IPv4 sites (in_pcb.c in_pcbbind_remote:884 and
in_pcbsetlport:428); its fix.diff guards only :884. This finding is the
unfiled IPv6 site (in6_src.c:473-476), reached via AF_INET6 sockets, in the
pass-2 target file.

## Fix validation

`fix.diff` adds the same `count == 0 -> EADDRNOTAVAIL` guard DF-0334 used at
in_pcb.c:884. Not build-validated on this run: the finding is a Low-severity
deterministic DoS (trap), not memory corruption, so a ~1 h nativekernel
rebuild was judged disproportionate for the batch; the guard is a literal
mirror of the already-validated sibling fix (fix_status: not_testable).
Behavior with fix: bind fails EADDRNOTAVAIL instead of panicking; ports on
non-zero-offset strata are unaffected (their path never divides by zero).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.