{
  "finding_id": "DF-3499",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Deterministic kernel panic on first ng_fec node creation at HEAD: ng_fec_get_unit() executes bcopy(NULL, newarray, 0) (ng_fec.c:276); DFlys bcopy macro (__builtin_memmove, sys/sys/systm.h:262) lets the compiler assume a non-NULL source even for zero length and elide the explicit NULL guard at ng_fec.c:280, so kfree(NULL) runs and panics (kern_slaballoc.c:1407). Verified by disassembly of the freshly built module (no test/branch before the kfree call mapped by DWARF to ng_fec.c:281) and reproduced 3x across boots, including with the stale installed module. With fix.diff (guard the bcopy) creation passes get_unit. Trigger is a single netgraph control message (root-only control socket on stock DFly), so impact is a root-triggerable local DoS / completely unusable module rather than an unprivileged primitive.",
  "exploit_chain": "",
  "evidence": "panic.txt (kfree(NULL) backtrace through ng_fec_constructor+0x39e <- ng_mkpeer); VERDICT.md (disassembly + DWARF line-mapping proof that the source guard is compiled out); fix.diff validated in-guest (ctor proceeds past get_unit)",
  "kernel_refs": [
    "sys/netgraph/fec/ng_fec.c:276",
    "sys/netgraph/fec/ng_fec.c:280",
    "sys/netgraph/fec/ng_fec.c:281",
    "sys/sys/systm.h:262",
    "sys/kern/kern_slaballoc.c:1407"
  ],
  "poc_changes": "none: stock module rebuilt from HEAD /usr/src in-guest; md5 of ng_fec.c verified identical to audit tree",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys/netgraph/fec && make",
  "run_cmd": "kldload ng_socket; kldload /usr/src/sys/netgraph/fec/ng_fec.ko; ngctl mkpeer fec c0 c1",
  "code_hash": "897c52870c28b2cb3d17a1e17ab3d67fbf1b0933ea10ec8c99ccba12a920ed3e",
  "notes": "The installed /boot/kernel/ng_fec.ko is a stale build that also lacks the guard; both it and the fresh HEAD build panic identically. Precondition for the control path: netgraph control socket (root on stock DFly). Subsequent panics after applying the fix belong to DF-3500 (netisr/ifnet_lock contract), not this finding.",
  "recommended_fix": "Guard the bcopy itself: if (ng_fec_units != NULL) bcopy(...) in ng_fec_get_unit()",
  "fix_status": "fixed",
  "fix_notes": "fix.diff applied in-guest, module rebuilt: mkpeer proceeds past ng_fec_get_unit without panic (creation then surfaces DF-3500, a separate defect); from thread context creation fully succeeds"
}