{
  "finding_id": "DF-3493",
  "title": "v1 ng_pppoe embeds the raw sess_con heap pointer in PADI HOST_UNIQ / PADO AC_COOKIE tags broadcast on the LAN (DF-3489 twin)",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "see ../DF-3491/build.sh",
    "run": "kldload ng_socket ng_pppoe && ../DF-3491/ppdprimed",
    "expected": "[DF-3493] AC-COOKIE = raw kernel sess_con pointer 0xfffff800... every round"
  },
  "kernel_refs": [
    "sys/netgraph/pppoe/ng_pppoe.c:829",
    "sys/netgraph/pppoe/ng_pppoe.c:1337",
    "sys/netgraph/pppoe/ng_pppoe.c:168",
    "sys/netgraph/pppoe/ng_pppoe.c:1039",
    "sys/netgraph/pppoe/ng_pppoe.c:1108"
  ],
  "artifacts": ["README.md", "leak_sample.txt", "manifest.json", "verdict.json"]
}