# DF-3482 — v1 ng_ppp compareLatencies/kqsort race (DF-0330's LIVE v1 twin)

## What this is
`ng_ppp_mp_strategy` (ng_ppp.c:1746-1749) uses the file-scope global
`compareLatencies` (ng_ppp.c:363) as qsort comparator state:
    compareLatencies = latency;      /* caller's STACK array */
    kqsort(sortByLatency, n, ..., ng_ppp_intcmp);   /* :1840 derefs */
    compareLatencies = NULL;
In netgraph7 every item funnels to cpu0, so DF-0330 called this latent.
In v1 (the LIVE stack) the ng_iface output path runs
ng_ppp_output -> ng_ppp_mp_output -> ng_ppp_mp_strategy in the SENDING
PROCESS'S THREAD (per-interface serializer only, no BGL, no netisr funnel),
so two bundles (or one bundle driven from two CPUs) execute strategy
concurrently: thread A stores NULL on exit while thread B is inside the
comparator -> NULL[index] read -> kernel panic.  Cross-bundle runs also make
B sort against A's DEAD STACK array (logic corruption / stale stack read).

## Verification outcome
INCONCLUSIVE — blocked on this stock guest: the plan was two ng_iface-fed
bundles ping-flooded from different CPUs, but ng_iface (and ng_eiface) node
CREATION panics the stock kernel deterministically:
    panic: trying to free NULL pointer
    _kfree() ... ng_iface_constructor+0x3a2 / ng_eiface_constructor+0xf6
    <- ng_mkpeer <- ng_generic_msg <- ng_send_msg
from a plain root `ngctl mkpeer . iface i0 inet` on a FRESH boot
(panic.iface_constructor.txt, panic.eiface_constructor.txt).  The ng_ether
upper-hook alternative severs the guest's ssh path, so no unfuneled output
feeder could be staged.  The defect itself is certain by inspection; the
reachability argument (v1's unfuneled output contexts) is documented in
DF-3481/VERDICT.md.

## Files
- pppstrat.c       — graph builder (2 bundles x 6 unequal links + ifaces)
- panic.iface_constructor.txt / panic.eiface_constructor.txt — blocker
- fix.diff         — replace global+kqsort with a local insertion sort
- manifest.json / verdict.json

## Build / run (guest, root)
    cc -O2 -w -o pppstrat pppstrat.c
    kldload ng_socket ng_ppp ng_ksocket ng_iface   # panics at mkpeer time
    ./pppstrat 2 && ping -f 10.240.0.9 & ping -f 10.241.0.9 &