{
 "finding_id": "DF-3472",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Line-accurate confirmation; latent by construction - raw_attach can fail solely at soreserve, and DragonFlys chgsbsize clamps instead of failing (always returns 1), so the failure path is unreachable in the current tree (proven in the DF sibling audit of soreserve). rts_attach assigns so->so_pcb = rp and takes a pcb soreference BEFORE raw_attach (rtsock.c:271-273); on failure it kfrees rop (:277-279) without clearing so->so_pcb or dropping the reference - the socket leaks holding a dangling pcb and a later raw_detach would LIST_REMOVE freed memory. Fix clears so_pcb and drops the pcb reference via sofree() on the error path; compiled in the F40FIX build.",
 "exploit_chain": "",
 "evidence": "VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff",
 "kernel_refs": [
  "sys/net/rtsock.c:271",
  "sys/net/rtsock.c:277",
  "sys/net/raw_usrreq.c:183"
 ],
 "poc_changes": "n/a - soreserve cannot fail on this tree",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 30,
 "guest_dirty": 0,
 "build_cmd": "see build.sh",
 "run_cmd": "see run.sh",
 "code_hash": null,
 "notes": "",
 "recommended_fix": "clear so_pcb and sofree() the pcb reference when raw_attach fails",
 "fix_status": "compile_validated",
 "fix_verdict": "fix.diff applied in the F40FIX verification kernel build (RC=0, zero -Werror errors); no runtime A/B for this item (line-certain hardening)"
}