# DF-3488 - VERDICT

**status: not_reproduced | reproduced: 0 | impact: none | confidence: likely**

Not reproduced on the harness kernel (NETGRAPH7_PPPOE compiled in, X86_64_NG7): 100 CONNECT/teardown cycles (pppoerace7.c, each arming a session with the 2s initial retransmit ticker, then RMHOOK tearing the session down around the ticker window) completed with no panic and no anomaly. The race remains code-certain: pppoe_ticker (ng_pppoe.c:1802-1804) unconditionally dereferences sp = NG_HOOK_PRIVATE(hook) then neg = sp->neg, while ng_pppoe_disconnect (:1788-1797) frees sp/neg and clears the hook private from the tearing thread; ng_uncallout cannot cancel a callout item already dequeued into the node's item queue, so a ticker item that wins the interleaving executes with sp == NULL -> guaranteed NULL+offset deref panic. The window is the item-queue drain vs disconnect (microseconds) per 2-second retransmit arm; 100 staggered cycles at ~100ms did not hit it. Root-triggered (graph construction) local DoS.

## Kernel references
- sys/netgraph7/pppoe/ng_pppoe.c:1788
- sys/netgraph7/pppoe/ng_pppoe.c:1797
- sys/netgraph7/pppoe/ng_pppoe.c:1803

## Evidence
pppoerace7.c, run.log (PPPOERACE7-DONE 100 cycles, no panic), harness kernel boot

## Recommended fix
add an sp==NULL benign-late-fire guard at the top of pppoe_ticker.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.