# DF-3493 — v1 ng_pppoe broadcasts the raw `sess_con` kernel heap pointer
in PADI/PADO discovery frames (DF-3489 twin)

File: `sys/netgraph/pppoe/ng_pppoe.c` (live stack)

## Root cause

* `pppoe_start()` client path (:812-835):
  `uniqtag.data.pointer = sp;` (:829) stuffed into a `PTT_HOST_UNIQ`
  tag that is **broadcast** in every PADI (:831-834, `eh_prototype`
  dst = ff:ff:ff:ff:ff:ff, :168-171).
* PRIMED/server path (:1297-1359):
  `uniqtag.data.pointer = sp;` (:1337) into a `PTT_AC_COOKIE` tag
  emitted in every PADO (:1355-1358).
* By protocol design both tags are echoed back by peers (PADO/PADR/PADS
  echo HOST_UNIQ / AC_COOKIE — :1039, :1108), so the pointer value is
  also present in unicast responses.

Any unauthenticated LAN observer of the (broadcast) discovery exchange
learns a live `struct sess_con` heap address (direct-map VA), defeating
KASLR-style heap randomization and providing slab reconnaissance for
follow-on corruption bugs (e.g. DF-3491's OOB walk, DF-0457's leak).

## Evidence (reproduced as a side artifact of the DF-3491 run)

The DF-3491 harness (`../DF-3491/ppdprimed.c`) captures the emitted
PADO; its AC-COOKIE tag (wire type 0x0104) is the raw pointer:

```
    tag wire-type=0x0104 len=8
    [DF-3493] AC-COOKIE = raw kernel sess_con pointer 0xfffff8008d9e46f0
```
(`../DF-3491/run.2.log`, 3/3 rounds; `../DF-3491/run.log`:
`0xfffff8008d9e65e0`. Raw bytes at PADO offset 0x3a5: `f0 46 9e 8d 00
f8 ff ff`.) `leak_sample.txt` holds the annotated hex.

## Fix (as FreeBSD's host_uniq hardening / ng7 DF-3489)

Replace the pointer with a random 64-bit cookie plus an indexed lookup
(hash table cookie→sess_con) so the on-wire value carries no address
information.

## Reproduce

Same harness as DF-3491: `kldload ng_socket ng_pppoe; ./ppdprimed` —
the AC-COOKIE line prints the pointer every round. (The client-side
PADI broadcast pointer at :829 is the same pattern; DF-3491's harness
exercises the server branch.)