{
  "finding_id": "DF-3441",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "div_bind()s unvalidated 4-byte zero write at offset 4..8 of a 4-byte user bind sockaddr provably executes on the guest (bind returns EINVAL from in_pcbbinds later sa_len check, not EAFNOSUPPORT from div_binds family gate \u2014 the write lines branch ran). The write lands inside the 8-byte slab chunks own slack (DF slab allocator rounds sub-128B requests to 8-byte multiples), so there is no adjacent-object corruption and no security impact; this is a correctness/UB hardening defect. A fixed kernel returns the same EINVAL, so the marker demonstrates path execution, not a behavioral difference.",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-3441/README.md \u2014 observed errno=22 (EINVAL) for bind(4B AF_INET sockaddr)"
  ],
  "kernel_refs": [
    "sys/netinet/ip_divert.c:456-479",
    "sys/netinet/ip_divert.c:472-477",
    "sys/kern/uipc_syscalls.c:1513-1532",
    "sys/kern/kern_slaballoc.c:638-645"
  ],
  "poc_changes": "none (first-shot PoC ran clean)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1 x86_64 (divert code identical to stock #0)",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o div3441 div3441.c",
  "run_cmd": "./div3441 (root)",
  "code_hash": "e3b544e1df08ad0d903833fd154546a266e82e5086dc6360df368761eed7f6ed",
  "notes": "Filed Low: language-level OOB write with no exploitable effect on this allocator; worth fixing alongside DF-3440 (same missing sa_len validation family in ip_divert.c).",
  "recommended_fix": "Validate nam->sa_len == sizeof(struct sockaddr_in) (and family) at the top of div_bind before zeroing sin_addr."
}