{
  "finding_id": "DF-3492",
  "title": "v1 pppoe_ticker NULL/UAF: callout fire races ng_pppoe_disconnect freeing sess/neg (DF-3488 twin)",
  "verdict": "not verified on guest (structural); see README.md",
  "impact_ceiling": "local/remote-timed kernel panic (DoS)",
  "kernel_refs": [
    "sys/netgraph/pppoe/ng_pppoe.c:1510",
    "sys/netgraph/pppoe/ng_pppoe.c:1514",
    "sys/netgraph/pppoe/ng_pppoe.c:1490",
    "sys/netgraph/pppoe/ng_pppoe.c:1495",
    "sys/netgraph/pppoe/ng_pppoe.c:1496",
    "sys/netgraph/pppoe/ng_pppoe.c:1181",
    "sys/netgraph/pppoe/ng_pppoe.c:1532"
  ],
  "artifacts": ["README.md", "manifest.json", "verdict.json"]
}