# DF-3496 - VERDICT

**status: not_reproduced | reproduced: 0 | impact: none | confidence: certain**

Dead code - unreachable by construction on this tree. (1) sys/netgraph7/ng_fec.c is commented out of the netgraph7 module SUBDIR (sys/netgraph7/Makefile, '#	fec \'), and (2) although conf/files:1704 lists it as 'optional netgraph7_fec', it CANNOT COMPILE: a kernel-compile attempt with options NETGRAPH7_FEC (harness config X86_64_NG7, stock X86_64_GENERIC base + NETGRAPH7 stack) failed with 76 errors - FreeBSD-5-era API usage: 'struct ifaltq_subque declared inside parameter list', 'IFF_DRV_RUNNING undeclared', 'implicit declaration of ifunit', 'IF_AFDATA_LOCK implicit', 'field fec_ch has incomplete type' (full log: ng7build-fecfail.log). This independently reproduces the pass-1 '81-error standalone build' finding. The code defect itself is line-accurate real: rcvmsg (:1287-1294) does 'ifname = msg->data' and passes it to addport/delport with no arglen/NUL validation; ifunit()/kprintf %s walk past the ng_mesg allocation until an incidental zero (same mechanism DEMONSTRATED LIVE on the v1 twin ng_fec.c, see DF-3506 pack: 'AAAAAAAAXXXX' over-read). Root-only control plane; fault/DoS-grade at slab boundaries.

## Kernel references
- sys/netgraph7/ng_fec.c:1287
- sys/netgraph7/ng_fec.c:1293
- sys/netgraph7/ng_fec.c:370

## Evidence
ng7build-fecfail.log (76 errors), Makefile excerpt, conf/files:1704, DF-3506 twin runtime demonstration

## Recommended fix
if the module is ever revived: memchr NUL + arglen check before use; otherwise delete the file.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.