# DF-3447 -- verification pack

**Method:** Live PoC on the QEMU guest (stock INVARIANTS kernel)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
Kernel mbuf-path BPF_LD|BPF_H|BPF_ABS ignores m_xhalf failure (merr unchecked, unlike the BPF_W twin two cases above): an out-of-range halfword load yields A=0 and the filter KEEPS RUNNING - fail-open. Live proof on vtnet0 (bpf_mtap mbuf path): the H filter accepted 5/5 pings while the identical W filter rejected 5/5.

## Build
```
cc -O -o <prog> <prog>.c   (on the guest)
```

## Run
```
(no arg; root)
```
(success criterion: see VERDICT.md)

## Evidence
live1.log DF-3447 section: packet 1-5 captured-by-H=1 captured-by-W=0

Kernel references: sys/net/bpf_filter.c:238-247, sys/net/bpf.c:1325