{
 "finding_id": "DF-3488",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "likely",
 "verdict": "Not reproduced on the harness kernel (NETGRAPH7_PPPOE compiled in, X86_64_NG7): 100 CONNECT/teardown cycles (pppoerace7.c, each arming a session with the 2s initial retransmit ticker, then RMHOOK tearing the session down around the ticker window) completed with no panic and no anomaly. The race remains code-certain: pppoe_ticker (ng_pppoe.c:1802-1804) unconditionally dereferences sp = NG_HOOK_PRIVATE(hook) then neg = sp->neg, while ng_pppoe_disconnect (:1788-1797) frees sp/neg and clears the hook private from the tearing thread; ng_uncallout cannot cancel a callout item already dequeued into the node's item queue, so a ticker item that wins the interleaving executes with sp == NULL -> guaranteed NULL+offset deref panic. The window is the item-queue drain vs disconnect (microseconds) per 2-second retransmit arm; 100 staggered cycles at ~100ms did not hit it. Root-triggered (graph construction) local DoS.",
 "evidence": "pppoerace7.c, run.log (PPPOERACE7-DONE 100 cycles, no panic), harness kernel boot",
 "kernel_refs": [
  "sys/netgraph7/pppoe/ng_pppoe.c:1788",
  "sys/netgraph7/pppoe/ng_pppoe.c:1797",
  "sys/netgraph7/pppoe/ng_pppoe.c:1803"
 ],
 "poc_changes": "pppoerace7.c written fresh (ng7 56-byte wire format, generic cookie 0x43c6511e)",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Sun Oct 25 20:46:48 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_NG7 x86_64 (harness kernel: X86_64_GENERIC + NETGRAPH7 stack)",
 "runtime_sec": 120,
 "guest_dirty": 0,
 "build_cmd": "gcc -O -o pppoerace7 pppoerace7.c",
 "run_cmd": "./pppoerace7 100 100000",
 "code_hash": "f460855e007260a7ac9d8115bd43936c19b893559912cb8a011440f7c50a0598",
 "notes": "ng7 pppoe otherwise fully functional on the harness kernel (PADI emit verified in DF-3489).",
 "recommended_fix": "add an sp==NULL benign-late-fire guard at the top of pppoe_ticker."
}