{
 "finding_id": "DF-3497",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "likely",
 "verdict": "Dead code - same construction-blocked status as DF-3496 (module commented out of the ng7 SUBDIR; kernel-compile with options NETGRAPH7_FEC fails with 76 errors, ng7build-fecfail.log). The claimed mechanism is line-accurate in source: ng_fec_shutdown/rmnode clean each port's fec_mc_head via ng_fec_ether_cmdmulti(priv->ifp, p, 0) at ng_fec.c:1337, but the direct DEL_IFACE path calls ng_fec_delport (:505-517) which TAILQ_REMOVE+kfree(p) with no cmdmulti cleanup - every DEL_IFACE leaks that port's ng_fec_mc nodes (M_DEVBUF) and leaves the driver-level multicast memberships programmed on the member. NOTE the v1 twin (DF-3508) was REFUTED because DFly ifioctl never dispatches SIOCADDMULTI to if_ioctl; the ng7 fec cmdmulti mechanism is different (it hooks if_resolvemulti-era SIOCADDMULTI forwarding at :455/:579-581 during addport and ioctl), but since the module cannot be built or loaded on this tree, neither arm is reachable. Root-gated resource leak.",
 "evidence": "ng7build-fecfail.log, source :455/:505-517/:579-581/:1337",
 "kernel_refs": [
  "sys/netgraph7/ng_fec.c:505",
  "sys/netgraph7/ng_fec.c:517",
  "sys/netgraph7/ng_fec.c:1337"
 ],
 "poc_changes": "none (unbuildable)",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "(see DF-3496) NETGRAPH7_FEC compile attempt",
 "run_cmd": "n/a",
 "code_hash": null,
 "notes": "fix_status: not_testable (unbuildable module).",
 "recommended_fix": "call ng_fec_ether_cmdmulti(priv->ifp, p, 0) before kfree(p) in ng_fec_delport."
}