# DF-3451 VERDICT

**Status: untested (Info-severity finding - Phase V intentionally skipped per
contract). Source-level proof complete; fix authored and diff-validated.**

The defect, effect analysis, and the fix are in README.md. Summary:
mld6_stop_listening (mld6.c:163-176) is the only MLD path mutating the shared
mld6_all_{nodes,routers}_linklocal templates and driving mld6_sendpkt without
mld6_token. Impact ceiling: lost/mis-addressed MLD DONE notifications and
mis-classified all-nodes comparisons under SMP concurrency (interface
leave on one CPU racing query/timeout processing on another). No memory
unsafety. fix.diff adds the token, mirroring start_listening (mld6.c:146).

Not re-reported (same root cause as DF-0691, covered by its fix): the
MLD_LISTENER_REPORT path's post-lookup in6m write at mld6.c:354-357.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.