# DF-3461 — in6_cksum() sanity check bypassable via u32 wrap of `off + len`

**Severity:** Info (defense-in-depth; no in-tree caller can reach it)
**File:** `sys/netinet6/in6_cksum.c:116-158`

## Build / run (guest, DragonFly 6.5-DEVELOPMENT, stock kernel #0)

```
ssh dfbsd 'cat > /tmp/wrap_demo.c' < wrap_demo.c
vm.sh run_root 'cd /tmp && cc -O2 -Wall -o wrap_demo wrap_demo.c && ./wrap_demo'
```

## Expected output

```
off=0xffffffff len=41 -> off+len=0x00000028 (40) wrapped=1
m->m_pkthdr.len=100: PASSES — sanity check BYPASSED
after walk: m=0x0 off=0xffffff9b -> w = mtod(m)+off = read (struct mbuf*)NULL->m_data -> kernel panic
```

This is a **userland arithmetic mirror** of the kernel code path, not a kernel
reproduction: the finding is Info/unreachable, so no kernel PoC was run (a KLD
that called `in6_cksum(m, nxt, 0xFFFFFFFF, 41)` would panic the guest —
proving only what the mirror already shows).

## What it demonstrates

1. `in6_cksum.c:116`: `m->m_pkthdr.len < off + len` — `off` and `len` are
   `u_int32_t`; `off + len` wraps mod 2^32, the comparison uses wrapped
   arithmetic, the "sanity" panic does not fire.
2. The offset walk (`:150-156`) exhausts the chain with `off` still huge,
   `m == NULL`.
3. `:157-158`: `w = mtod(m, ...) + off; mlen = m->m_len - off;` dereference
   the NULL mbuf → low-page fault → panic (not a controlled panic message).

## Why Info

Every in-tree caller derives `off`/`len` from bounded quantities (u16
`ip6_plen` after the `ip6_input.c:628-638` clamp/trim, plus each transport's
`IP6_EXTHDR_CHECK` pull-up) — none can produce a wrapping sum. See VERDICT.md
for the full caller matrix.