{
  "finding_id": "DF-3434",
  "title": "ipfw3 check_keep_state(): limit-type keep-state rules leak a state per duplicate packet and kprintf('oops')-flood the console per packet",
  "verdict": "reproduced",
  "impact": "dos",
  "reproduce": {
    "build": "cc -O2 -o /tmp/state_oops /tmp/state_oops.c",
    "run": "root: sh fwsetup.sh (installs '00099 allow udp from any to any keep-state limit src-port 100' + catch-all allow); then as an unprivileged user: /tmp/state_oops 320",
    "expected": "dmesg grows ~2 'oops' lines per packet; M_IPFW3_STATE inuse grows one 64B allocation per duplicate rule evaluation (46 -> 646 for 320 packets observed)"
  },
  "kernel_refs": [
    "sys/net/ipfw3_basic/ip_fw3_state.c:296",
    "sys/net/ipfw3_basic/ip_fw3_state.c:301",
    "sys/net/ipfw3_basic/ip_fw3_state.c:317",
    "sys/net/ipfw3_basic/ip_fw3_state.c:319",
    "sys/net/ipfw3_basic/ip_fw3_state.c:327",
    "lib/libipfw3/basic/ipfw3_basic.c:562"
  ],
  "artifacts": [
    "state_oops.c", "setup_root.sh", "run.sh", "run.log", "fix.diff",
    "run.patched.log", "manifest.json", "verdict.json"
  ]
}