{
 "finding_id": "DF-3496",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Dead code - unreachable by construction on this tree. (1) sys/netgraph7/ng_fec.c is commented out of the netgraph7 module SUBDIR (sys/netgraph7/Makefile, '#\tfec \\'), and (2) although conf/files:1704 lists it as 'optional netgraph7_fec', it CANNOT COMPILE: a kernel-compile attempt with options NETGRAPH7_FEC (harness config X86_64_NG7, stock X86_64_GENERIC base + NETGRAPH7 stack) failed with 76 errors - FreeBSD-5-era API usage: 'struct ifaltq_subque declared inside parameter list', 'IFF_DRV_RUNNING undeclared', 'implicit declaration of ifunit', 'IF_AFDATA_LOCK implicit', 'field fec_ch has incomplete type' (full log: ng7build-fecfail.log). This independently reproduces the pass-1 '81-error standalone build' finding. The code defect itself is line-accurate real: rcvmsg (:1287-1294) does 'ifname = msg->data' and passes it to addport/delport with no arglen/NUL validation; ifunit()/kprintf %s walk past the ng_mesg allocation until an incidental zero (same mechanism DEMONSTRATED LIVE on the v1 twin ng_fec.c, see DF-3506 pack: 'AAAAAAAAXXXX' over-read). Root-only control plane; fault/DoS-grade at slab boundaries.",
 "evidence": "ng7build-fecfail.log (76 errors), Makefile excerpt, conf/files:1704, DF-3506 twin runtime demonstration",
 "kernel_refs": [
  "sys/netgraph7/ng_fec.c:1287",
  "sys/netgraph7/ng_fec.c:1293",
  "sys/netgraph7/ng_fec.c:370"
 ],
 "poc_changes": "none (unbuildable)",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 1500,
 "guest_dirty": 0,
 "build_cmd": "make nativekernel KERNCONF=X86_64_NG7   # with options NETGRAPH7_FEC",
 "run_cmd": "n/a (module cannot be built on this tree)",
 "code_hash": null,
 "notes": "DF-3058-style dead-code treatment with fresh compile evidence. fix_status: not_testable (unbuildable).",
 "recommended_fix": "if the module is ever revived: memchr NUL + arglen check before use; otherwise delete the file."
}