{
 "finding_id": "DF-3463",
 "status": "not_reproduced",
 "reproduced": 0,
 "poc_path": "findings/poc/DF-3463",
 "artifact_dir": "findings/poc/DF-3463",
 "build_cmd": "cc -O -o <prog> <prog>.c   (on the guest)",
 "run_cmd": "(no arg; root)",
 "code_hash": "da44b40bc23af24b9ecb6c07e1d412b913df70b692ccf4d804692fa18f0835e1",
 "build_log": "(inline)",
 "run_log": "live2.log",
 "impact": "none",
 "confidence": "likely",
 "verdict": "gre_input sets m_pkthdr.rcvif = &sc->sc_if (ip_gre.c:192) with no lifetime tie; ip_reass keeps fragments for IPFRAGTTL=60 slow-ticks (~30s) with no per-interface purge, so a fragment riding gre0 survives if_detach and completes reassembly later through freed gre_softc memory. CONTROL PROVEN LIVE: an inner 127.0.0.1 packet fragmented through gre0 is rejected by the :544 rcvif->if_flags read (mechanism exercised); after destroy+reassembly the read demonstrably happens again on freed memory - but with identical rejection outcome (freed slab retains the old flags), and 20 aggressive recycle attempts (24 lo ifnets each, same-zone kmalloc churn) never landed a loopback ifnet at the stale address, so no observable delta/crash.",
 "exploit_chain": "",
 "evidence": "live2.log greuaf section: control rejected as expected; attempts 1-20 rejected (no acceptance)",
 "kernel_refs": [
  "sys/netinet/ip_gre.c:184-193",
  "sys/netinet/ip_input.c:541-548",
  "sys/netinet/ip_input.c:977-1100"
 ],
 "poc_changes": "",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "notes": "",
 "recommended_fix": "",
 "fix_status": "not_testable",
 "fix_verdict": "Fix: clear/purge reass queues on if_detach or take an ifnet reference for queued fragments; not A/B-able without an observable recycle.",
 "fix_baseline_reproduced": null,
 "fix_patched_reproduced": null
}