{
  "finding_id": "DF-3465",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Dead-code functional defect demonstrated empirically: force-wired the subsystem with a shim KLD (wireshim.c) on the guest - the cloner works (ipfw0 create/destroy fine), the event handler fires on every detach and no-ops (signature mismatch: receives the cloner as its ifp; if_dunit reads low32 of the ifc_destroy field, always out of [0,10)). As shipped, log N actions silently do nothing (ip_fw3_log_modevent never called by the module glue; ip_fw3_log_ptr never assigned). DF-0748s OOB read is doubly unreachable. No memory corruption - silent detective-control failure + latent never-initialized lock.",
  "exploit_chain": "n/a (dead code; demonstration only)",
  "evidence": [
    "findings/poc/DF-3465/REFUTATION.md",
    "findings/poc/DF-3465/wireshim.c",
    "findings/poc/DF-3465/run.sh"
  ],
  "kernel_refs": [
    "sys/net/ipfw3_basic/ip_fw3_log.c:213-243",
    "sys/net/ipfw3_basic/ip_fw3_basic.c:644-660",
    "sys/net/ipfw3/ip_fw3.c:134",
    "sys/sys/eventhandler.h:123"
  ],
  "poc_changes": "verdict.json reconstructed by the orchestrator (pack held REFUTATION.md/wireshim/run.sh but no verdict.json).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 X86_64_GENERIC",
  "runtime_sec": 600,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o wireshim wireshim.c (shim KLD build)",
  "run_cmd": "sh findings/poc/DF-3465/run.sh",
  "code_hash": null,
  "notes": "Fix: wire ip_fw3_log_modevent in ipfw3_basic_modevent, assign ip_fw3_log_ptr, fix the event-handler signature.",
  "recommended_fix": "Wire the modevent + assign the function pointer + correctly-signed wrapper for the ifnet_detach_event registration; validate log_if_table id bounds per DF-0748."
}