# DF-3432 — udp6_connect() reads sin6_addr before sa_len validation

DF-3357/DF-3372/DF-3415 read-before-validate family, `udp6_usrreq.c`
instance. Unprivileged `connect(2)` on an AF_INET6 SOCK_DGRAM socket
with a 17-byte sockaddr makes the kernel read `sin6_addr` bytes 8..19 —
3 bytes past the allocation — and pick the errno from them.

## Reproduce

```
build:  cc -O2 -Wall -o udp6_connect_oob udp6_connect_oob.c
run:    su -m maxx -c ./udp6_connect_oob        # unprivileged
```

(or `./run.sh` for build + 3 stress runs)

## Expected (observed 3×20 rounds, 100% stable)

```
A groom 00 ff ff : EADDRNOTAVAIL=20 EINVAL=0 other=0
B groom 00 00 00 : EADDRNOTAVAIL=0 EINVAL=20 other=0
C no groom       : EADDRNOTAVAIL=0 EINVAL=20 other=0
RESULT: VULNERABLE -- udp6_connect()'s errno is chosen by heap bytes
        OUTSIDE the supplied sockaddr length
```

Variant A vs B differ only in heap bytes at offsets 17..19 — outside
the 17-byte sockaddr the user handed to connect(2).

## Files

- `udp6_connect_oob.c` — PoC source
- `run.sh`, `build.log`, `run.log` — exact commands + full output
- `VERDICT.md` — full narrative, attribution, impact ceiling
- `fix.diff` — sa_len validation at top of udp6_connect() (git-apply-check OK)
- `manifest.json`, `verdict.json`, `env.txt`