{
  "finding_id": "DF-3475",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ng_callout() (ng_base.c:3247-3269) reads callout_arg(c) into oitem and drops it; re-arming a still-pending ng_callout orphans the prior item together with its NG_NODE_REF (node never freed, type never unloadable, M_NETGRAPH item leak). Certain code defect by inspection; no in-tree caller currently re-arms a pending ng_callout (all re-arms occur inside the fired callback after the item was consumed), so no reachable trigger exists today - filed as Info hardening. Phase V skipped per contract (Info severity).",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-3475/README.md",
    "findings/poc/DF-3475/VERDICT.md",
    "findings/poc/DF-3475/fix.diff"
  ],
  "kernel_refs": [
    "sys/netgraph7/netgraph/ng_base.c:3247"
  ],
  "poc_changes": "n/a - analysis-only finding",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 (no guest execution - Info severity)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Skipped Phase V (Info/hardening). The read-then-ignore of oitem is dead code that visibly intended the FreeBSD-style reclaim; the fix restores it with the DF-3474 refs==0 caveat.",
  "recommended_fix": "Free/commit the previously armed oitem in ng_callout() (see fix.diff)."
}