# REFUTATION RECORD (kept for DF-0748 triage) — candidate "ifnet_detach_event
# double-free in ip_fw3_log.c" — investigated as reserved DF-3465, refuted.

## Candidate (pass-2 hypothesis)

`ip_fw3_log_clone_destroy()` (sys/net/ipfw3_basic/ip_fw3_log.c:182-206) is
registered as a handler for the GLOBAL `ifnet_detach_event`
(ip_fw3_log.c:222-225) with the same signature as the cloner's
`ifc_destroy`.  Hypothesis: any interface detach/rename with `if_dunit`
colliding with a live `ipfwN` clone unit would type-confuse the victim ifnet
into `bpfdetach()/if_detach()/if_free()` — recursive double detach + double
free (and via SIOCSIFNAME, if.c:2206, a mid-rename full detach+free).

## Why it is NOT reachable in this tree (two independent blockers)

### Blocker 1 — the whole ipfw3 log-if subsystem is dead code

* `ip_fw3_log_modevent()` (ip_fw3_log.c:213) — the only function that
  attaches the "ipfw" cloner and registers the event handler — has **no
  caller anywhere in the tree**.  `ipfw3_basic_modevent()`
  (sys/net/ipfw3_basic/ip_fw3_basic.c:644-660) wires only
  `ip_fw3_state_modevent` and `ip_fw3_table_modevent`, NOT the log one.
* `ip_fw3_log_ptr` (sys/net/ipfw3/ip_fw3.c:134) is initialized to NULL and
  never assigned; `check_accept`/`check_deny` (ip_fw3.c:252,263) guard on it
  and therefore never call `ip_fw3_log()` — so DF-0748's OOB table index is
  equally unreachable in-tree.
  Consequence: `log_if_lock` is never `lockinit`'d and `log_if_table[]`
  stays all-NULL.  (Filed separately as an Info/Low dormancy finding.)

### Blocker 2 — even when wired, the handler is a guaranteed silent no-op

`ifnet_detach_event_handler_t` is `void (*)(void *, struct ifnet *)`
(sys/net/if_var.h:724) and `EVENTHANDLER_INVOKE` calls
`eh_func(ee_arg, args...)` — **ctx FIRST, payload second**
(sys/sys/eventhandler.h:123).  `ip_fw3_log_clone_destroy` is
`int (*)(struct ifnet *)`, so when invoked as an event handler:

* its `ifp` parameter actually receives the registered context
  `&ipfw3_log_cloner` — a *static `struct if_clone`*, not an ifnet;
* the REAL detaching ifnet arrives as an ignored second argument.

Measured on the audit guest (kernel X86_64_GENERIC #0, module base
0xffffffff8264a000, `ipfw3_log_cloner` @ +0xc0 from the .ko symtab):

```
offsetof(struct ifnet, if_dunit) = 56
sizeof(struct if_clone)          = 64   (ifc_name@16, ifc_minifs@24, ifc_maxunit@28)
struct if_clone field @56        = low 4 bytes of ifc_destroy
                                   = low32(&ip_fw3_log_clone_destroy) ~ 0x8264xxxx
```

So the fake `if_dunit` is the low half of a kernel text pointer (>=
0x80000000 on every x86_64/i386 DFly link), which is always >= LOG_IF_MAX
(10): the handler returns EINVAL on every invocation.  Empirically confirmed:
with the subsystem force-wired by `wireshim.ko` (below), destroying/renaming
interfaces fires the handler (my tracer saw every event) and nothing
happened; `ipfw0` create/destroy via the cloner kept working.

## Artifacts here

* `wireshim.c` — KLD that performs exactly the missing one-line wiring
  (`ip_fw3_log_modevent(MOD_LOAD)`) plus a correctly-signed tracer handler.
  Used to empirically demonstrate blockers 1+2 on the guest.
* `run.sh` — the trigger sequence that was tried (destroy + rename paths).
* Guest observations (dmesg/serial) are quoted in this file; the double-free
  never manifested.

## Incidental guest observation (different file, NOT this candidate)

While unloading the wired stack, the guest panicked in `rn_flush` — this is
`ip_fw3_table_fini_dispatch()` (sys/net/ipfw3_basic/ip_fw3_table.c:576-587)
calling `rn_flush(table_ctx->node, ...)` for every table id although
`table_ctx->node` is only `rn_inithead`'d when a table is *created*
(ip_fw3_table.c:96-107).  `kldunload ipfw3_basic` with zero configured
tables NULL-derefs (`rn_flush(NULL)` -> read of 0x28).  Root-triggerable
local DoS, out of this batch's file scope — reported to the orchestrator in
the JSON `notes` for a dedicated audit.