{
 "finding_id": "DF-3424",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "Deterministic one-shot kernel panic reproduced on the stock INVARIANTS guest: with net.inet.ip.portrange.first==last==1032 (RANGECHK accepts first==last), an unprivileged AF_INET6 ephemeral bind executing on the portinfo stratum with offset==0 reaches in6_src.c:476 rounddown(cut % lport, step) with lport==0 and takes an integer-divide fault (Fatal trap 18, Stopped at in6_pcbsetlport+0x126: divl %esi,%eax, cpuid=0). DoS only - a trap, not a corruption primitive.",
 "exploit_chain": "",
 "evidence": [
  "panic.txt: Fatal trap 18: integer divide fault + Stopped at in6_pcbsetlport+0x126: divl %esi,%eax (the cut % lport at in6_src.c:476)",
  "run.log: sysctl 1024->1032 / 5000->1032 then trigger; guest immediately down",
  "VERDICT.md: in_pcbportrange arithmetic showing first==last==1032 for ofs==0, step=6"
 ],
 "kernel_refs": [
  "sys/netinet6/in6_src.c:473",
  "sys/netinet6/in6_src.c:476",
  "sys/netinet/in_pcb.c:148",
  "sys/netinet/in_pcb.c:2533"
 ],
 "poc_changes": "Seed sketch (none existed - pass-2 discovery): wrote 12-thread AF_INET6 bind(::,0) spinner since guest lacks cpuset(1); port value 1032 chosen divisible by netisr-ncpus(6) so CPU0s stratum (ofs=0) collapses first==last via in_pcbportrange.",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026   root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 42,
 "guest_dirty": 1,
 "build_cmd": "sh build.sh",
 "run_cmd": "sh run.sh",
 "code_hash": "61ade5089693a8049381fe78e7a1ba537a3f239f314a44cbcaa7714d8239eeb6",
 "notes": "DF-0334 owns the v4 sites (in_pcb.c:884/:428) and its fix.diff guards only :884; this v6 site in6_src.c:473-476 was unfiled. Trigger side needs no privilege after the root sysctl misconfig; v4 twin fires from the same sysctls. Guest was reset (vm.sh reset with-src) after capture for the next PoC.",
 "recommended_fix": "Guard lport==0 after in_pcbportrange() in in6_pcbsetlport (in6_src.c:473) with return EADDRNOTAVAIL, mirroring DF-0334s fix at in_pcb.c:884; see fix.diff.",
 "fix_status": "not_testable",
 "fix_kernel_uname": "",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "Guard is a literal mirror of the sibling DF-0334 fix (in_pcb.c:884, already validated in that pack); nativekernel rebuild skipped as disproportionate for a Low deterministic-trap DoS in this 3-file batch.",
 "fix_evidence": [
  "fix.diff"
 ]
}