# DF-3448 — sysctl_ip6_tempvltime restores the wrong variable (and keeps the rejected value)

File: `sys/netinet6/in6_proto.c` (pass 2)

## What

`sysctl_ip6_tempvltime()` (sys/netinet6/in6_proto.c:437-453) guards the
RFC-4941 invariant `valid_lifetime >= preferred_lifetime`. When a write
violates it, the intended behavior (matching the KAME/FreeBSD original) is
to restore the OLD valid lifetime and fail with EINVAL.

DragonFly's copy instead does:

```c
old = ip6_temp_valid_lifetime;
error = SYSCTL_IN(req, arg1, sizeof(int));      /* arg1 == &ip6_temp_valid_lifetime */
if (ip6_temp_valid_lifetime < ip6_temp_preferred_lifetime) {
        ip6_temp_preferred_lifetime = old;      /* BUG: wrong variable */
        return (EINVAL);
}
```

Two effects on every rejected write:

1. the **rejected** `ip6_temp_valid_lifetime` value stays installed (the
   restore never touches it), and
2. `ip6_temp_preferred_lifetime` is clobbered with the old *valid* lifetime.

## Impact

Root-only sysctl misconfiguration persistence + corruption of the IPv6
privacy-address (temporary address, RFC 4941) lifetime configuration:
`preferred > valid` afterwards, so subsequent temporary-address management
(in6_ifadd.c) computes lifetimes from an inconsistent state (addresses can
be treated as valid long past their preferred expiry, or regenerate on the
wrong schedule). No memory-safety impact. Severity: Low.

## Reproduce (in the QEMU guest, as root)

```
sh /tmp/df3448_trigger.sh        # or: scp trigger.sh over and run it
```

Expected output on a vulnerable kernel (see run.log / run.2.log):

```
== attempting invalid write: tempvltime=100 (100 < pltime 86400) ==
sysctl: net.inet6.ip6.tempvltime=100: Invalid argument
== state after rejected write ==
pltime=604800  vltime=100
BUG PART 1 CONFIRMED: rejected tempvltime=100 persisted (should still be 604800)
BUG PART 2 CONFIRMED: temppltime clobbered to 604800 (old vltime; should still be 86400)
```

Note the extra trap: `sysctl -w` prints the *old* value (`604800`) in its
diagnostic while the kernel variable is actually left at `100` — an admin
reading the error output would believe the write was fully rejected.

Build: none needed (shell-only trigger).