# DF-3504 - VERDICT

**status: reproduced | reproduced: 1 | impact: none | confidence: certain**

Condition reproduced on the harness kernel: kaccept.c creates an ng7 ksocket listener (hook inet6/stream/6), binds [::]:7799, LISTENs, requests NGM_KSOCKET_ACCEPT (which arms response_addr), then connects from a normal IPv6 socket; the ACCEPT response received on the control socket reports cmd=3 arglen=32 = offsetof(struct ng_ksocket_accept, addr)=4 + sa_len=28 (sockaddr_in6) - exactly twice the 16-byte declared `struct sockaddr addr` (ng_ksocket.h:78-81). finish_accept bcopies the full sa_len into that fixed-typed field (ng_ksocket.c:1250-1252); the copy is in-bounds of the kmalloc'd response (allocated with OFFSETOF+sa_len), so this is the filed ABI/type-confusion hazard rather than memory corruption: any consumer type-punning the response with sizeof(struct sockaddr) (or copying sizeof(addr)) silently truncates 12+ bytes of address. Latent consumer-facing defect; no in-tree victim identified (ngctl's parse uses the generic sockaddr type).

## Kernel references
- sys/netgraph7/ksocket/ng_ksocket.c:1250
- sys/netgraph7/ksocket/ng_ksocket.c:1252
- sys/netgraph7/ksocket/ng_ksocket.h:80

## Evidence
run.log (ACCEPT resp cmd=3 arglen=32 vs sizeof(sockaddr)=16 + CONFIRMED line), kaccept.c

## Recommended fix
declare addr as struct sockaddr_storage (ABI bump) or document arglen-based consumption.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.