{
 "finding_id": "DF-3489",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "leak",
 "confidence": "certain",
 "verdict": "Reproduced on the harness kernel (NETGRAPH7_PPPOE; ng7 is not in the stock kernel - harness required, per DF-2539 rig convention). ppptest.c builds the graph my-node --c0--> pppoe:session0 plus my-node e0 <--> pppoe:ethernet with a data socket associated to the node, sends NGM_PPPOE_CONNECT, and reads the emitted PADI directly off the ethernet hook. The captured PADI (40 bytes) contains tag 0x0103 PTT_HOST_UNIQ len=8 value bytes 80 ba 74 89 00 f8 ff ff = 0xfffff8008974ba80 little-endian - a live kernel direct-map heap pointer (ng_pppoe.c:1071 'uniqtag.data.pointer = sp;' and the PRIMED twin at :1228). Every PADI/PADO is broadcast on the segment, so any unauthenticated LAN observer harvests a kernel heap address (KASLR-style defeat / heap-layout reconnaissance). FIX VALIDATED A/B: with fix.diff applied (random karc4random64 cookie per session + cookie-based finduniq), the identical test on the rebuilt kernel emits ed f6 48 5b 58 d4 a5 0b - a random cookie, no kernel pointer - while the session machinery still produces the same PADI.",
 "exploit_chain": "passive LAN sniffer -> broadcast PADI -> HOST_UNIQ tag = kernel heap pointer; value feeds heap-grooming for any follow-on corruption bug",
 "evidence": "run.log (PADI hexdump with 0103/8/80ba748900f8ffff and the fixed-kernel rerun 0edf6485b58d4a50b), ppptest.c, fix.diff, padi.pcap path",
 "kernel_refs": [
  "sys/netgraph7/pppoe/ng_pppoe.c:1071",
  "sys/netgraph7/pppoe/ng_pppoe.c:1228",
  "sys/netgraph7/pppoe/ng_pppoe.c:580"
 ],
 "poc_changes": "ppptest.c written fresh (ng7 wire format; graph includes data-socket association to capture frames without touching the real NIC)",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Sun Oct 25 20:46:48 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_NG7 x86_64 (harness kernel: X86_64_GENERIC + NETGRAPH7 stack)",
 "runtime_sec": 1800,
 "guest_dirty": 0,
 "build_cmd": "gcc -O -o ppptest ppptest.c   (harness kernel X86_64_NG7)",
 "run_cmd": "./ppptest",
 "code_hash": "9f231b8bdae72a7d9cdd63b41e0d52d186b77e55522042a25eb99067857d7fc8",
 "notes": "fix_status: fixed (A/B: pointer -> random cookie on patched kernel #1 21:34:11).",
 "recommended_fix": "random 64-bit per-session HOST_UNIQ cookie with cookie-based session lookup (see fix.diff)."
}