{
 "finding_id": "DF-3498",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "likely",
 "verdict": "Dead code - unbuildable on this tree (module SUBDIR commented out; NETGRAPH7_FEC kernel compile fails with 76 errors - ng7build-fecfail.log; see DF-3496). The cross-bundle enslavement claim is line-accurate in source: the duplicate check at ng_fec.c:382-389 only scans THIS bundle's ports, addport then overwrites IFP2NG(bifp) (:417-419) and saves new->fec_if_input = bifp->if_input which is ALREADY ng_fec_input from the first bundle (:437-446), and delport (:505) restores if_input = p->fec_if_input = ng_fec_input with IFP2NG NULLed - leaving every subsequent RX frame calling ng_fec_input over a NULL/freed node (RX blackhole or freed-node deref). The MECHANISM was demonstrated live on the buildable v1 twin (DF-3507 pack: cross-enslave ac_netgraph switch + stale pointer after delport, FECDMP evidence). ng7 arm unreachable: cannot build. Root-gated misconfiguration-turned-DoS.",
 "evidence": "ng7build-fecfail.log, source :382-446/:505-509, DF-3507 twin runtime demonstration",
 "kernel_refs": [
  "sys/netgraph7/ng_fec.c:382",
  "sys/netgraph7/ng_fec.c:418",
  "sys/netgraph7/ng_fec.c:441",
  "sys/netgraph7/ng_fec.c:505"
 ],
 "poc_changes": "none (unbuildable)",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "(see DF-3496)",
 "run_cmd": "n/a",
 "code_hash": null,
 "notes": "fix_status: not_testable (unbuildable module).",
 "recommended_fix": "reject members whose if_input is already ng_fec_input or whose IFP2NG is non-NULL."
}