{
  "finding_id": "DF-3495",
  "verdict": "not_reproduced",
  "impact": "none",
  "confidence": "likely",
  "reproduce": {
    "build": "kldload ng_socket ng_ksocket ng_l2tp; cc -O2 -Wall -pthread -o /tmp/l2tp_hook_uaf /tmp/l2tp_hook_uaf.c",
    "run": "/tmp/l2tp_hook_uaf 90 2 3   (root on the DF guest)",
    "expected": "On a kernel where the lower-hook feeder runs off cpu0: '*** UAF HIT' lines and delivered s3 > 0 (cross-session misdelivery via freed+reallocated hook), or panic. On this guest (all ng_socket/ng_ksocket paths pinned to cpu0 netisr): delivered s3 = 0 and all net.graph.l2probe stale counters = 0 despite 2.3M hook frees."
  },
  "kernel_refs": [
    "sys/netgraph/l2tp/ng_l2tp.c:769-781",
    "sys/netgraph/l2tp/ng_l2tp.c:861-882",
    "sys/netgraph/l2tp/ng_l2tp.c:661-664",
    "sys/netgraph/netgraph/ng_base.c:831-858",
    "sys/netgraph/netgraph/ng_base.c:1678-1699",
    "sys/kern/uipc_socket.c:248-259",
    "sys/netinet/ip_demux.c:462-476"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "l2tp_hook_uaf.c", "l2tp_hook_uaf_eiface.c",
    "build.sh", "run.sh", "build.log", "run.log", "env.txt",
    "probe.diff", "fix.diff", "panic.txt", "manifest.json", "verdict.json"
  ]
}