{
  "finding_id": "DF-3439",
  "title": "ipfw3 skipto next_rule stale-cache use-after-free: rule deletion leaves dangling cached target; packet path executes freed rule (deny-all blackhole) and wild filter_funcs dispatch (panic)",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O -o ipfw3x ipfw3x.c && cc -O -o krules krules.c -lkvm",
    "run": "./run.sh (as root on the guest; phases split across ssh calls)",
    "expected": "with rules live: ping 100% loss; after `del 200`: ICMP still denied / console floods 'ouch!' / ssh blackholes; with debug.use_weird_array=1: Fatal trap 9 GPF at ip_fw3_chk+0x1a4"
  },
  "kernel_refs": [
    "sys/net/ipfw3_basic/ip_fw3_basic.c:175-185",
    "sys/net/ipfw3_basic/ip_fw3_basic.c:104-124",
    "sys/net/ipfw3/ip_fw3.c:288-307",
    "sys/net/ipfw3/ip_fw3.c:757-768",
    "sys/net/ipfw3/ip_fw3.c:824-841",
    "sys/net/ipfw3/ip_fw3.c:485-507",
    "sys/net/ipfw3/ip_fw3.c:573-578"
  ],
  "artifacts": [
    "ipfw3x.c", "krules.c", "kfdump.c", "run.sh", "run.log",
    "panic.txt", "panic_runA3.raw", "blackhole_console.txt", "fix.diff",
    "VERDICT.md", "verdict.json", "manifest.json"
  ]
}