# DF-3457 — gif(4) destroy races in-flight gif_output (UAF -> panic)

Repro: unprivileged user floods traffic through a root-configured gif0
tunnel while root churns `ifconfig gif0 destroy`/create.  The destroy
path frees/NULLs `gif_psrc`/`gif_pdst` (and later the whole softc)
without holding gif0's ifnet serializer, while `gif_output()`
(in any sender thread) holds that serializer and dereferences the
same fields mid-encapsulation.

## Files
* `flood.c`   — unprivileged flooder (build: `cc -O2 -o flood flood.c`;
                run as non-root: `./flood 6 10.99.0.1`)
* `churn.sh`  — root-side create/destroy loop (`./churn.sh 300`)
* `run.log`   — full decisive run incl. control + panic capture
* `panic.txt` — kernel panic from the serial console
* `fix.diff`  — validated one-hunk fix (ifnet_serialize_all in
                gif_clone_destroy)
* `env.txt`   — guest state
* `verdict.json` / `manifest.json` — machine records

## Exact steps (single-tenant QEMU guest, 6 vCPU, INVARIANTS kernel)
```
# root setup
ifconfig gif0 create
ifconfig gif0 tunnel 127.0.0.1 127.0.0.99    # blackhole outer dst:
                                             # encapped pkts never echo
ifconfig gif0 10.98.0.1 10.98.0.2 up
route add -net 10.99.0.0/24 -iface gif0

# unprivileged side (maxx)
cc -O2 -o flood flood.c
./flood 6 10.99.0.1        # ~25k pps aggregate (keep netisr0 alive)

# root side
./churn.sh 300             # ~15-20 create/destroy cycles per second
```

## Expected result (vulnerable kernel)
Within ~1-2 minutes:
```
Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x1
Stopped at  gif_output+0x128:  movzbl 0x1(%rax),%eax
```
(`sc->gif_psrc` NULLed between if_gif.c:346 guard and :373 deref.)

## Expected result (patched kernel, fix.diff applied)
No panic for the full run; guest stays up; flood reports
EAFNOSUPPORT=0 throughout.