{
  "finding_id": "DF-3452",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code-level defect is certain and directly visible: ip_fw3_sync_send_state() (sys/net/ipfw3_basic/ip_fw3_sync.c:437-467) initializes only cmd.type/cmd.cpu/cmd.hash of the on-stack struct cmd_send_state (:448-450) and then memcpys the entire struct - including the uninitialized struct ipfw_flow_id flow (14B), expiry, lifetime and rulenum - into an mbuf that is sent as a UDP datagram to every sync edge (:452, :458-465): ~28 bytes of kernel stack per synced state entry to a network peer (CWE-908). NOT reproduced at runtime because the code is dead twice over, verified both in-source and on the guest: (1) ip_fw3_ctl_sync_ptr (ip_fw3.c:133) is never assigned, so all IP_FW_SYNC_* sockopts are silent no-ops - on-guest setsockopt(IP_FW_X, SYNC_SHOW_STATUS) and (SYNC_CENTRE_TEST) both returned rc=0 with no dmesg output and no state change, while a live handler would kprintf (centre not running, ip_fw3_sync.c:325); (2) ipfw_sync_send_state_prt is assigned at MOD_LOAD (:474) but has no caller anywhere in sys/. Latent, same class as the pass-1 DF-0700..DF-0706 LATENT findings for this dead subsystem; becomes a live remote kernel-stack disclosure the moment anyone wires the pointer up. Low severity (latent), Phase V runtime skipped per contract.",
  "exploit_chain": "",
  "evidence": [
    "ip_fw3_sync.c:443-452: struct cmd_send_state cmd on stack, three fields set, memcpy of the whole struct into the outgoing mbuf",
    "ip_fw3_sync.c:458-465: datagram sent to every fw3_sync_ctx centre socket",
    "ip_fw3_sync.h:93-102: struct cmd_send_state layout (flow: struct ipfw_flow_id, expiry, lifetime, rulenum left uninitialized)",
    "ip_fw3.c:133 + :1124-1128: ip_fw3_ctl_sync_ptr never assigned - sync sockopts dead; contrast ip_fw3_state.c:699 / ip_fw3_table.c:608 which do assign their pointers",
    "df3452_dead.c + on-guest output: SET SYNC_SHOW_STATUS rc=0, SET SYNC_CENTRE_TEST rc=0, no kernel messages - silent no-op, dead path confirmed"
  ],
  "kernel_refs": [
    "sys/net/ipfw3_basic/ip_fw3_sync.c:437",
    "sys/net/ipfw3_basic/ip_fw3_sync.c:448",
    "sys/net/ipfw3_basic/ip_fw3_sync.c:452",
    "sys/net/ipfw3_basic/ip_fw3_sync.c:458",
    "sys/net/ipfw3_basic/ip_fw3_sync.c:474",
    "sys/net/ipfw3/ip_fw3.c:133",
    "sys/net/ipfw3/ip_fw3.c:1125"
  ],
  "poc_changes": "df3452_dead.c written to prove the sockopt deadness on-guest (setsockopt IP_FW_X with sync opcodes returns success while doing nothing).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Sun Sep 13 01:13:18 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/PRNOINV  x86_64",
  "runtime_sec": 40,
  "guest_dirty": 0,
  "build_cmd": "cc -o /root/df3452_dead /home/maxx/df3452_dead.c",
  "run_cmd": "kldload ipfw3 && kldload ipfw3_basic (after sysctl -w net.filters_default_to_accept=1 to keep ssh alive); /root/df3452_dead; dmesg | tail",
  "code_hash": "b0b9820ccb21e1cd523c97eeccc92b0ec8ad78623cbf659419e4b02a6ce52d7e",
  "notes": "Loading ipfw3_basic with default filters_default_to_accept=0 blocks all traffic and kills ssh (ipfw3 initialized, default to deny) - run with the sysctl set to 1 first. En-route observation for a future pass: kldunload ipfw3_basic panicked in rn_flush+0x1d (NULL deref) on the non-INVARIANTS kernel - ip_fw3_table.c teardown bug, outside this batch.",
  "recommended_fix": "bzero cmd before populating the three fields (fix.diff), or populate flow/expiry/lifetime/rulenum from the synced state"
}