# DF-3489 - VERDICT

**status: reproduced | reproduced: 1 | impact: leak | confidence: certain**

Reproduced on the harness kernel (NETGRAPH7_PPPOE; ng7 is not in the stock kernel - harness required, per DF-2539 rig convention). ppptest.c builds the graph my-node --c0--> pppoe:session0 plus my-node e0 <--> pppoe:ethernet with a data socket associated to the node, sends NGM_PPPOE_CONNECT, and reads the emitted PADI directly off the ethernet hook. The captured PADI (40 bytes) contains tag 0x0103 PTT_HOST_UNIQ len=8 value bytes 80 ba 74 89 00 f8 ff ff = 0xfffff8008974ba80 little-endian - a live kernel direct-map heap pointer (ng_pppoe.c:1071 'uniqtag.data.pointer = sp;' and the PRIMED twin at :1228). Every PADI/PADO is broadcast on the segment, so any unauthenticated LAN observer harvests a kernel heap address (KASLR-style defeat / heap-layout reconnaissance). FIX VALIDATED A/B: with fix.diff applied (random karc4random64 cookie per session + cookie-based finduniq), the identical test on the rebuilt kernel emits ed f6 48 5b 58 d4 a5 0b - a random cookie, no kernel pointer - while the session machinery still produces the same PADI.

## Kernel references
- sys/netgraph7/pppoe/ng_pppoe.c:1071
- sys/netgraph7/pppoe/ng_pppoe.c:1228
- sys/netgraph7/pppoe/ng_pppoe.c:580

## Exploit chain
passive LAN sniffer -> broadcast PADI -> HOST_UNIQ tag = kernel heap pointer; value feeds heap-grooming for any follow-on corruption bug

## Evidence
run.log (PADI hexdump with 0103/8/80ba748900f8ffff and the fixed-kernel rerun 0edf6485b58d4a50b), ppptest.c, fix.diff, padi.pcap path

## Recommended fix
random 64-bit per-session HOST_UNIQ cookie with cookie-based session lookup (see fix.diff).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.