# DF-3498 - VERDICT

**status: not_reproduced | reproduced: 0 | impact: none | confidence: likely**

Dead code - unbuildable on this tree (module SUBDIR commented out; NETGRAPH7_FEC kernel compile fails with 76 errors - ng7build-fecfail.log; see DF-3496). The cross-bundle enslavement claim is line-accurate in source: the duplicate check at ng_fec.c:382-389 only scans THIS bundle's ports, addport then overwrites IFP2NG(bifp) (:417-419) and saves new->fec_if_input = bifp->if_input which is ALREADY ng_fec_input from the first bundle (:437-446), and delport (:505) restores if_input = p->fec_if_input = ng_fec_input with IFP2NG NULLed - leaving every subsequent RX frame calling ng_fec_input over a NULL/freed node (RX blackhole or freed-node deref). The MECHANISM was demonstrated live on the buildable v1 twin (DF-3507 pack: cross-enslave ac_netgraph switch + stale pointer after delport, FECDMP evidence). ng7 arm unreachable: cannot build. Root-gated misconfiguration-turned-DoS.

## Kernel references
- sys/netgraph7/ng_fec.c:382
- sys/netgraph7/ng_fec.c:418
- sys/netgraph7/ng_fec.c:441
- sys/netgraph7/ng_fec.c:505

## Evidence
ng7build-fecfail.log, source :382-446/:505-509, DF-3507 twin runtime demonstration

## Recommended fix
reject members whose if_input is already ng_fec_input or whose IFP2NG is non-NULL.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.