{
  "finding_id": "DF-3495",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "The session-hook/hpriv use-after-free is real in the code (unreferenced hook+hpriv cached from a lockless LIST_FOREACH at ng_l2tp.c:769-781 and used ~13us later at 861-882 while ng_l2tp_disconnect() at 661-664 kfrees hpriv on any concurrent rmhook), but it could not be triggered on this DragonFly guest: in-kernel probes prove 100% of both the data path and the control path execute on cpu0s netisr thread (ng_socket so_port = netisr_cpuport(0); ng_ksockets UDP socket port pinned to its creation cpu = cpu0), so the free and the use never overlap. Decisive run: 2,309,380 hook frees vs 173,656 deliveries with 13.1us average lookup-to-delivery windows and zero stale-hook/stale-hpriv observations (probes stale_inv/stale_realloc/hpriv_bad all 0, userspace s3-oracle 0). The one constructible off-cpu0 feeder (ng_eiface transmit path) panics at node creation on INVARIANTS kernels (known DF-3486); ng_ether-fed lower hooks remain the theoretically-exposed configuration but cannot be driven on this SLIRP-only guest. Filed as Low: hardening-grade on DragonFly today, live for any non-socket feeder context.",
  "exploit_chain": "",
  "evidence": "run.log (final 90s run: 2.3M frees, 0 hits + deliv_cpu/free_cpu sysctls showing 100% cpu0); VERDICT.md (full root cause); probe.diff (diagnostic counters); l2tp_hook_uaf.c (PoC); l2tp_hook_uaf_eiface.c (eiface variant tripping DF-3486); panic.txt",
  "kernel_refs": [
    "sys/netgraph/l2tp/ng_l2tp.c:769",
    "sys/netgraph/l2tp/ng_l2tp.c:882",
    "sys/netgraph/l2tp/ng_l2tp.c:661",
    "sys/netgraph/netgraph/ng_base.c:831",
    "sys/netgraph/netgraph/ng_base.c:1678",
    "sys/kern/uipc_socket.c:259",
    "sys/netinet/ip_demux.c:462"
  ],
  "poc_changes": "Complete harness authored from scratch (no seed): netgraph graph builder via raw NGM_* control messages, L2TP-over-UDP injector via ng_ksocket, rmhook/connect teardown churn, s3-arrival misdelivery oracle, plus a guest-local diagnostic ng_l2tp module patch (probe.diff) adding net.graph.l2probe.* counters (frees/deliv/stale_inv/stale_realloc/hpriv_bad/walk timing/per-CPU histograms) to observe the race from inside the kernel. Iterations: ng_socket-lower variant, ksocket variants (single + 64-socket pools), 20KB/32KB/64KB offset-strip packets, eiface variant.",
  "attempts": 9,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 7200,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -pthread -o /tmp/l2tp_hook_uaf /tmp/l2tp_hook_uaf.c",
  "run_cmd": "/tmp/l2tp_hook_uaf 90 2 3",
  "code_hash": "92375480a56637934605a30704caa1c7e2cba13e6f029eb68a21a840e2efa06c",
  "notes": "Known findings excluded per pass-2 instructions: DF-0492 (timer vs data-path seq/xwin/priv race \u2014 remains the live race in this file; its timer side runs in softclock which is NOT serialized with cpu0) and DF-0493 (KASSERT-only nack bound). DF-0462/0463 are the ng7 files findings. The eiface panic re-confirmed during verification is the already-filed DF-3486. Guest was panicked once by the eiface attempt and force-recovered; left clean via reset with-src.",
  "recommended_fix": "Hold a hook reference across the cached lookup-to-delivery span in ng_l2tp_recv_lower() and defer the hpriv free to node shutdown (dead list); see fix.diff",
  "fix_status": "not_testable",
  "fix_notes": "fix.diff authored (hook ref + deferred hpriv free) but not kernel-validated: the race does not reproduce on this guest (cpu0 serialization), so baseline and fixed kernels are observationally identical"
}