{
  "finding_id": "DF-3451",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Info-severity locking-consistency defect, source-proven, deliberately not exercised at runtime per contract (Info findings skip Phase V): mld6_stop_listening (sys/netinet6/mld6.c:163-176) writes the shared globals mld6_all_nodes_linklocal / mld6_all_routers_linklocal and sends the MLD DONE without mld6_token, while every other path touching those globals (start_listening mld6.c:146, mld6_input mld6.c:201, fasttimeo mld6.c:382) holds it. Concurrent leave vs query/timeout on an SMP box yields torn if_index embeddings: mis-classified ff02::1 comparisons in the QUERY walk and DONE packets addressed with a foreign interface id (lost leave notification, group traffic persists for the robustness interval). No memory-safety impact - fixed-size globals - hence Info. fix.diff mirrors start_listenings token-across-send pattern; no new lock order introduced.",
  "exploit_chain": "",
  "evidence": [
    "README.md (source citations mld6.c:146-160 vs :163-176 vs :201/:269/:327/:382)",
    "fix.diff"
  ],
  "kernel_refs": [
    "sys/netinet6/mld6.c:163",
    "sys/netinet6/mld6.c:146",
    "sys/netinet6/mld6.c:201",
    "sys/netinet6/mld6.c:382"
  ],
  "poc_changes": "none - no runnable PoC produced for an Info finding per contract",
  "attempts": 0,
  "guest_uname": "n/a (source-level analysis only)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "",
  "notes": "Related family: DF-0691/DF-0692 (in6m lifetime) - this is the shared-template variant with benign failure mode. The REPORT-path in6m write at mld6.c:354-357 after the unlocked IN6_LOOKUP_MULTI return is NOT re-reported here: same root cause as DF-0691 and fixed by the same mld6_token-in-in6_delmini change.",
  "recommended_fix": "Wrap mld6_stop_listenings body in lwkt_gettoken(&mld6_token)/lwkt_reltoken(&mld6_token), mirroring mld6_start_listening."
}