# DF-3452 VERDICT — uninitialized stack in ip_fw3_sync_send_state (LATENT)

## Reproduced? No — dead code (verified), defect certain at code level

The initialization gap is directly visible at ip_fw3_sync.c:443-452:
`struct cmd_send_state cmd;` on the stack; only `.type` (448), `.cpu`
(449), `.hash` (450) assigned; `memcpy(m->m_data, &cmd, len)` with
len = sizeof(struct cmd_send_state) (~48 bytes incl. `flow` 14B,
`expiry` 4B, `lifetime` 2B, `rulenum` 4B + padding) ships the rest as
kernel stack garbage to every sync peer over UDP (ip_fw3_sync.c:458-465).

## Reachability — dead, proven two ways

1. **Sockopt path dead (on-guest verified)**: `ip_fw3_ctl_sync_ptr`
   (sys/net/ipfw3/ip_fw3.c:133) is never assigned anywhere in the tree;
   the IP_FW_SYNC_* case in ip_fw3_ctl() (ip_fw3.c:1124-1128) checks the
   pointer and does nothing. On-guest: `setsockopt(IPPROTO_IP, IP_FW_X,
   {opcode=IP_FW_SYNC_SHOW_STATUS})` and `{opcode=IP_FW_SYNC_CENTRE_TEST}`
   both returned rc=0 with no dmesg output and no state change — a live
   handler would have kprintf'd "ipfw3sync: centre not running"
   (ip_fw3_sync.c:324-326). Contrast: `ip_fw3_ctl_state_ptr`
   (ip_fw3_state.c:699) and `ip_fw3_ctl_table_ptr` (ip_fw3_table.c:608)
   ARE assigned by their modevent hooks — sync is dead by omission.
2. **Send path dead (source-grep)**: `ipfw_sync_send_state_prt` is
   assigned at MOD_LOAD (ip_fw3_sync.c:474) and called nowhere.

## Impact if wired

Each synced state entry leaks ~28 bytes of kernel stack over UDP to the
configured sync edges — remote kernel-stack info disclosure to the sync
peer (CWE-908/CWE-209). Same LATENT family as pass-1 DF-0700..DF-0706.

## Fix

`fix.diff`: one-line `bzero(&cmd, sizeof(cmd))` before populating the
intended fields. Runtime fix validation meaningless (dead code).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.