{
  "finding_id": "DF-3492",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Structural analysis only (same discipline as the ng7 twin DF-3488): pppoe_ticker() dereferences hook->private and sp->neg at :1514-1515 before any state check, while ng_pppoe_disconnect() stops the callout (:1490), frees sp->neg and sp (:1493,:1495) and clears hook->private (:1496) from the tearing thread. callout_stop() cannot recall an already-entered callout on another CPU, so a ticker firing concurrently with hook teardown (remote PADT during the 2-64s retransmit window, or ethernet-hook loss) reads NULL (guaranteed panic) or freed memory (UAF). Not QEMU-verified: Low-severity race requiring a callout hammer to hit reliably; mechanism is source-identical to the already-filed ng7 finding.",
  "exploit_chain": "",
  "evidence": "README.md (line-cited structural analysis); compare ng7 DF-3488 evidence pack",
  "kernel_refs": [
    "sys/netgraph/pppoe/ng_pppoe.c:1510",
    "sys/netgraph/pppoe/ng_pppoe.c:1514",
    "sys/netgraph/pppoe/ng_pppoe.c:1490",
    "sys/netgraph/pppoe/ng_pppoe.c:1495",
    "sys/netgraph/pppoe/ng_pppoe.c:1496",
    "sys/netgraph/pppoe/ng_pppoe.c:1181",
    "sys/netgraph/pppoe/ng_pppoe.c:1532"
  ],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Filed from structural analysis per pass-2 discipline; race window = ticker fire (2-64s backoff) vs hook teardown. The DF-3491 packs harness creates SOFFER sessions with armed 16s tickers and tears the graph down at exit, exercising the neighborhood but not deterministically the race.",
  "recommended_fix": "Guard ticker entry: sp = hook->private; if (sp == NULL) return; under crit_enter(), and synchronize teardown with the callout (callout_stop_sync or equivalent) before freeing sp/neg"
}