# DF-3440 — VERDICT

**Status: not_reproduced** (impact demonstrated as `none`; the defect itself
is source-certain and its code path provably executes).

## What is certain (source)

- `div_send` -> `div_output` with zero validation between `getsockaddr()`
  (4-byte minimum allocation) and the field reads (ip_divert.c:344-350).
- `sin_port` (4..8) becomes `divinfo->skipto` — the firewall resume rule on
  reinject; `sin_addr` (8..12) selects ip_output vs ip_input.
- For namelen=4 (8-byte chunk): sin_port = own-chunk slack (recycled heap),
  sin_addr = **adjacent chunk** bytes 0..4.

## What was demonstrated on the guest

- `sendto(divert_fd, pkt, 48, {4-byte sockaddr}, 4)` **succeeds** (rc=48) —
  the under-sized sockaddr flowed through div_output and the packet was
  reinjected (ip counters moved). Same for 9-byte sockaddrs. 12+ shots.
- The OUTPUT/INPUT branch machinery works (16-byte controls produced the
  expected reinject signatures in `netstat -s -p ip` deltas).

## What could NOT be demonstrated

- Deterministic steering/readback of the OOB bytes:
  - counter oracles are per-CPU/noisy on DF;
  - the ipfw hooks exist only in the ether layer (if_ethersubr.c:466,1061),
    so loopback reinjects never re-match a divert rule;
  - with one_pass=0 the resume rule equals the very skipto bytes under test
    (never < 100 in observed heap states -> rule 100 never re-matched);
  - groom chunks are not the ones the trigger allocation picks (identical
    conclusion to the *verified* DF-3357 PoC on this same guest/allocator).
- Hence: no observable value leak to record; classified not_reproduced with
  impact none. The defect remains real (read-past-object into kernel control
  flow on a root-only socket) — filed Medium on code certainty, consistent
  with the DF-0650 twin (unvalidated rip_send sockaddr, filed Medium).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)