# DF-3446 -- verification pack

**Method:** Live PoC on the QEMU guest (stock INVARIANTS kernel)
**Status:** REPRODUCED | impact: denial_of_service | confidence: certain

## What this is
Duplicate ipfw3 table appends leak the radix entry: rnh_addaddr failure path never frees ent (and reports success to userland). Live on the stock kernel: 10000 duplicate adds of 10.7.7.7/32 leaked ~7.4MB of M_IPFW3_TABLE (in-use 12.0K -> 14.7MB in an earlier 20000-add run), table count still 1; entries are not in the tree so flush/destroy cannot reclaim them - unbounded kernel memory exhaustion as root.

## Build
```
cc -O -o <prog> <prog>.c   (on the guest)
```

## Run
```
(driver script; kldload ipfw3+ipfw3_basic)
```
(success criterion: see VERDICT.md)

## Evidence
live3.log fw3 section: IPFW3_TABLE in-use before/after 10000 dup appends; table count 1

Kernel references: sys/net/ipfw3_basic/ip_fw3_table.c:157-186