{
 "finding_id": "DF-3467",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "likely",
 "verdict": "Attempted and not reproduced. The vulnerable code path was exercised at full rate: ipfw3+ipfw3_basic+ipfw3_layer4 loaded on the stock guest, rule '100 allow udp from any to any uid 1001' active, and six unprivileged (uid 1001) threads raced 3,599,984 UDP socket()/connect()/send()/close() cycles against 10.0.2.2 so the output-direction check_uid ran in the sender threads (ipfw3 counter 00100 = 3,599,984 packets / 331,198,528 bytes matched by the uid rule) while concurrent close(2) storms tore the pcbs down. Zero panics, zero anomalies across all runs; guest healthy after. The UAF window between in_pcblookup_hash() (ip_fw3_layer4.c:120/125, no pcbinfo token held) and the inp_socket deref (:130/:136/:139) is a handful of instructions against the detaching CPUs hash-removal - the finding remains code-plausible (lookup takes no reference and no token; the wildcard path in the same file shows the intended token discipline) but did not manifest in 3.6M matched packets under a close storm. Read-only UAF ceiling (panic at most) unchanged.",
 "exploit_chain": "",
 "evidence": "run.log (full ipfw3 show counters + RACEUID-DONE lines), raceuid.c",
 "kernel_refs": [
  "sys/net/ipfw3_layer4/ip_fw3_layer4.c:120",
  "sys/net/ipfw3_layer4/ip_fw3_layer4.c:130",
  "sys/net/ipfw3_layer4/ip_fw3_layer4.c:136"
 ],
 "poc_changes": "raceuid.c written fresh (cpuset_setaffinity does not exist on DFly; pinning replaced by 6 busy threads spread by the LWKT scheduler)",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 210,
 "guest_dirty": 0,
 "build_cmd": "gcc -O -pthread -o raceuid raceuid.c",
 "run_cmd": "ipfw3 add 100 allow udp from any to any uid 1001; ./raceuid 60 (x3 rounds)",
 "code_hash": "37925c87e2c1fa3ab2819474d634168b35abddf1862145abde78bbea80cc9c14",
 "notes": "ipfw3 loads default-deny (self-DoS hazard when loading via ssh); rules must be installed from a nohup script. Counters prove the rule (and thus check_uid) evaluated per packet.",
 "recommended_fix": "hold the per-CPU pcbinfo token across lookup+dereference in ip_fw3_match_guid (as the wildcard path does), or take a pcb reference."
}