# DF-3486 VERDICT — REPRODUCED (panic, deterministic, root-only)

## Bottom line

Every creation of an `ng_eiface` node panics the stock kernel:
`panic: try holding ifnet lock in netisr` from `ifnet_lock()` ←
`if_attach()` ← `ether_ifattach_bpf()` ← `ng_eiface_constructor+0xf6`.
The constructors of the v1 netgraph interface nodes run in the netgraph
control-message path, which executes on a `TD_TYPE_NETISR` thread; `if_attach()`
is structurally forbidden there (ifnet lock KASSERT at sys/net/if.c:3787,
plus `netmsg_service_sync()` at if.c:741 which would self-deadlock).
`ng_iface` carries the same latent defect (ng_iface.c:605 `if_attach`,
ng_iface.c:801 `if_detach` in rmnode) — hidden on the stock kernel only
because DF-3485 panics earlier; demonstrated directly in
panic.iface_path.txt.

## How it was proven

1. Live reproduction, stock modules, fresh boot: `ngctl mkpeer . eiface e0
   ether` → instant panic; full trace captured first-hand (panic.txt).
   Deterministic on every attempt.
2. The DF-3482 lead's recorded message for this panic ("trying to free NULL
   pointer") was shown to be a truncation artifact: the actual console
   message and the two `ifnet_lock` frames were captured intact here.
3. Offsets resolved via module DWARF: `+0xf6` = return address of the
   `call ether_ifattach` at `+0xf1` (ng_eiface.c:356).
4. ng_iface variant reproduced with a DF-3485-only-fixed module (panic.
   iface_path.txt) — proving both files are affected and that
   `ng_iface_rmnode`'s if_detach is a further instance.
5. Fix validated (module rebuilds only): with fix.diff, both mkpeer
   triggers SUCCEED, `ng0`/`ngeth0` appear in ifconfig, `ngctl shutdown`
   is clean, and 22+ rapid create/destroy cycles (exercising
   PENDING/RUNNING/DONE/DYING/DETACHING transitions) produced zero panics;
   the guest stayed up (fix_run.log).

## Reachability / severity

Root-only (ng_socket.c:172 `caps_priv_check(SYSCAP_RESTRICTEDROOT)`; EPERM
verified for uid 1001). Impact: deterministic kernel panic — on INVARIANTS
kernels; on production kernels a netisr self-deadlock (hang) instead.
No memory corruption. Severity Low. These v1 modules are effectively
unusable crash-on-sight as shipped (they cannot have worked on any kernel
containing the ifnet_lock netisr assertion), i.e. this is long-standing
rot in the legacy v1 netgraph interface nodes, not a regression.

## Fix notes / residual

- The fix moves ifnet attach/detach into short-lived kernel threads with an
  ownership-transfer state machine (spinlock-protected). Validated for
  create / list / ifconfig / connect-hook / shutdown / rapid cycling.
- Not exercised by ngctl: `ng_eiface_rmnode`'s DONE-state path (ngctl's
  node-ID addressing did not resolve for the unnamed eiface node); that
  path is the unchanged original down-block, now merely gated on
  attach_state == DONE, and its state machine is identical in structure to
  ng_iface's validated one.
- Data through hooks racing an in-flight attach (rcvdata before if_attach
  completes) is a pre-existing semantic gap in these modules; the fix does
  not widen it (the node is hook-connectable only after the constructor
  returns, and ifnet fields are initialized before the thread starts).
- Upstream may prefer outright retirement of the v1 iface/eiface modules
  (netgraph7 provides equivalents); the fix demonstrates the defect is
  module-local and repairable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.