# DF-3503 - VERDICT

**status: not_reproduced | reproduced: 0 | impact: none | confidence: likely**

Unreachable by construction on this tree: the attack vector requires ng_tag to mint a short m_tag, but sys/netgraph7/ng_tag.c DOES NOT COMPILE - kernel-compile with options NETGRAPH7_TAG failed at ng_tag.c:64 'fatal error: sys/stddef.h: No such file or directory' (FreeBSD-ism; DFly has no sys/stddef.h), and ng_tag is absent from the netgraph7 module SUBDIR (sys/netgraph7/Makefile). With no in-tree producer of foreign NGM_KSOCKET_COOKIE m_tags except ng_ksocket itself (which always writes the full sizeof(struct sa_tag) tag), the short-tag OOB in ng7 ng_ksocket rcvdata (:904-913 - m_tag_locate by cookie/type only, no m_tag_len check, sa=&stag->sa handed to sosend) cannot be armed. The code defect is line-accurate real; a custom kernel module minting a short tag would realize it, but that is not an in-tree surface on this tree. (DFly's v1 twin ng_tag/ksocket was fixed differently; v1 rcvdata uses meta not m_tags.)

## Kernel references
- sys/netgraph7/ksocket/ng_ksocket.c:904
- sys/netgraph7/ksocket/ng_ksocket.c:913
- sys/netgraph7/ng_tag.c:64

## Evidence
ng7build.log attempt-1 (ng_tag.c:64 fatal error captured in session log; config then rebuilt without TAG), sys/netgraph7/Makefile SUBDIR listing

## Recommended fix
validate tag->m_tag_len >= sizeof(struct sa_tag) - offsetof(sa) before overlaying sa_tag in ng7 ng_ksocket_rcvdata.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.