{
  "finding_id": "DF-3450",
  "title": "encap4_input ipip_input hook: unlocked double-read test-then-call races ip_mroute KLD unload (no netisr drain) -> NULL call / execute-after-unmap panic",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "(cd /usr/src/sys/net/ip_mroute && make obj && make); cc -O2 -o sprayer sprayer.c",
    "run": "(/root/sprayer 96 &) ; (sh racer.sh &) ; watch dfbsd-qemu/vm.sh log",
    "expected": "within ~25-100 s: Fatal trap 12, RIP either 0x0 (call-NULL) or inside the unloaded ip_mroute.ko text range (execute-after-unmap), current process = Idle (netisr0)"
  },
  "kernel_refs": [
    "sys/netinet/ip_encap.c:231",
    "sys/netinet/ip_encap.c:107",
    "sys/net/ip_mroute/ip_mroute.c:3266",
    "sys/net/ip_mroute/ip_mroute.c:3285",
    "sys/netinet/ip_demux.c:315"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "sprayer.c",
    "racer.sh",
    "panic.txt",
    "run.2.log",
    "console_full.txt",
    "console_run2.txt",
    "fixattempt1_single_sided.log",
    "console_fixrun.txt",
    "env.txt",
    "fix.diff",
    "code_hash.txt",
    "verdict.json",
    "manifest.json"
  ]
}