{
  "finding_id": "DF-3500",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "ng_fecs entire control plane violates the ifnet locking contract and runs in netisr: (1) the constructor calls ether_ifattach -> if_attach -> ifnet_lock() from a TD_TYPE_NETISR thread (KASSERT panic try holding ifnet lock in netisr, sys/net/if.c:3787); (2) ng_fec_rmnode calls ng_fec_stop which does an unbalanced ifnet_deserialize_all (IS_SERIALIZED assertion panic, ng_fec.c:549/1222); (3) ng_fec_delport calls the members if_ioctl(SIOCSIFFLAGS) without the member serializer (vtnet_serialize_assert panic, ng_fec.c:454-455). All three reproduced on the INVARIANTS guest (facets 2/3 from thread context via fecdrive.ko because facet 1 blocks the stock csock path); on production kernels these remain sleep-in-netisr / lock-order hazards. Root-triggered (netgraph control socket), so impact = deterministic panic + non-INVARIANTS locking hazard, not an unprivileged primitive.",
  "exploit_chain": "",
  "evidence": "panic_ctor_netisr.txt (facet 1: ifnet_lock <- if_attach <- ether_ifattach_bpf <- ng_fec_constructor <- ng_mkpeer); panic_rmnode_delport.txt (facets 2 and 3 verbatim serial-console panics); VERDICT.md",
  "kernel_refs": [
    "sys/netgraph/fec/ng_fec.c:1137",
    "sys/netgraph/fec/ng_fec.c:549",
    "sys/netgraph/fec/ng_fec.c:1222",
    "sys/netgraph/fec/ng_fec.c:454",
    "sys/net/net/if.c:3787"
  ],
  "poc_changes": "facet-1 run needs the one-line DF-3499 guard applied first (DF-3499 panics earlier otherwise); facets 2/3 driven from thread context with fecdrive.ko (sources in ../DF-3501/) because the stock csock path cannot reach them",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1800,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys/netgraph/fec && make   # + patch -s < DF-3499/fix.diff for facet 1",
  "run_cmd": "kldload ng_socket; kldload ./ng_fec.ko; ngctl mkpeer fec c0 c1   # facets 2/3: fecdrive create/add/shutdown",
  "code_hash": "e8cf25ff47210caf1634a98849d42b0c3a21526ed2c514447dbbe92969d59bae",
  "notes": "Facet 2 panic captured before its enabler existed (clean stock path); facet 3 captured with only unrelated enablers present. The correct fix is structural (defer if work out of netisr; serialize member ioctls), so no one-line fix.diff is validated.",
  "recommended_fix": "Defer interface attach/detach and member ioctls out of netisr context and hold each members serializer around if_ioctl (structural fix)",
  "fix_status": "not_testable",
  "fix_notes": "structural fix required; verification instead used three documented lab enablers (E1 DF-3499 guard, E2 skip ng_fec_stop in rmnode, E3 serialize delport member ioctl) to reach the deeper DF-3501/DF-3502 defects"
}