{
  "finding_id": "DF-3493",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "v1 ng_pppoe puts the raw struct sess_con heap pointer on the wire: pppoe_start() :829 (PTT_HOST_UNIQ in the broadcast PADI, eh_prototype dst ff:ff:ff:ff:ff:ff at :168-171) and the PRIMED branch :1337 (PTT_AC_COOKIE in every PADO), with peers echoing both tags by design (:1039, :1108). Reproduced as a side artifact of the DF-3491 run: the captured PADOs AC-COOKIE = 0xfffff8008d9e46f0 / 0xfffff8008d9e65e0 (direct-map kernel VA), printed 3/3 rounds. Passive LAN observers of the broadcast discovery exchange learn a live kernel heap address \u2014 KASLR-style defeat and slab reconnaissance for companion bugs (DF-3491/DF-0457 OOB walks).",
  "exploit_chain": "passive listener on LAN segment captures broadcast PADI/PADO -> extracts sess_con pointer -> heap layout knowledge feeds exploitation of memory-corruption bugs in the same zone",
  "evidence": "leak_sample.txt (annotated raw bytes); ../DF-3491/run.2.log ([DF-3493] AC-COOKIE = ... 0xfffff8008d9e46f0 3/3); ../DF-3491/run.log (0xfffff8008d9e65e0)",
  "kernel_refs": [
    "sys/netgraph/pppoe/ng_pppoe.c:829",
    "sys/netgraph/pppoe/ng_pppoe.c:1337",
    "sys/netgraph/pppoe/ng_pppoe.c:168",
    "sys/netgraph/pppoe/ng_pppoe.c:1039",
    "sys/netgraph/pppoe/ng_pppoe.c:1108"
  ],
  "poc_changes": "No dedicated harness needed: the DF-3491 PADO capture carries the AC_COOKIE; PoC prints it directly.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "see findings/poc/DF-3491/build.sh",
  "run_cmd": "kldload ng_socket ng_pppoe && findings/poc/DF-3491/ppdprimed",
  "code_hash": "0cbff5b8b903480fc342d496a63bef241b545ca33febc22a8ba22ebcbf410e99",
  "notes": "v1 twin of ng7 DF-3489 (verified there with a LAN capture; here evidenced from the emitted-frame capture, same mechanism).",
  "recommended_fix": "Replace the pointer with a random 64-bit cookie and an indexed (hash) lookup cookie->sess_con, as in FreeBSDs host_uniq hardening"
}