{
  "finding_id": "DF-3436",
  "title": "ipfw3_basic MOD_UNLOAD is unguarded and unsynchronized: fini/callout/netmsg races (self-re-arming cleanup callout vs callout_stop; cleanup dispatch on NULL context; table radix teardown walk) - kernel panic",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "(no build; shell loop)",
    "run": "sh /tmp/bounce_basic.sh 4000   (root; ipfw3 loaded)",
    "expected": "Fatal trap 12, fault VA 0x28, current process Idle (netisr0), Stopped at rn_flush+0x1d within minutes"
  },
  "kernel_refs": [
    "sys/net/ipfw3_basic/ip_fw3_state.c:539",
    "sys/net/ipfw3_basic/ip_fw3_state.c:542",
    "sys/net/ipfw3_basic/ip_fw3_state.c:584",
    "sys/net/ipfw3_basic/ip_fw3_state.c:592",
    "sys/net/ipfw3_basic/ip_fw3_state.c:683",
    "sys/net/ipfw3_basic/ip_fw3_state.c:691",
    "sys/net/ipfw3_basic/ip_fw3_basic.c:651"
  ],
  "artifacts": [
    "bounce_basic.sh", "panic.txt", "README.md", "VERDICT.md", "fix.diff",
    "run.patched.log", "manifest.json", "verdict.json"
  ]
}