# DF-3442 -- verification pack

**Method:** Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
iface_match() runs kfnmatch() on rule-supplied via/xmit/recv names the kernel never validates for NUL termination. Stock ipfw3(8) terminates via strlcpy (libipfw3 fill_iface), so exposure needs a hand-crafted root setsockopt; harness (fnmatch == kfnmatch semantics) with a 16-byte all-glob non-terminated name faults the guard page.

## Build
```
./build.sh
```

## Run
```
df3442 oob
```
(success criterion: see VERDICT.md)

## Evidence
non-terminated glob name rc=139; terminated control rc=0; FIXED termination check clean

Kernel references: sys/net/ipfw3_basic/ip_fw3_basic.c:134-141, sys/net/ipfw3/ip_fw3.h:191-198