{
 "finding_id": "DF-3504",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Condition reproduced on the harness kernel: kaccept.c creates an ng7 ksocket listener (hook inet6/stream/6), binds [::]:7799, LISTENs, requests NGM_KSOCKET_ACCEPT (which arms response_addr), then connects from a normal IPv6 socket; the ACCEPT response received on the control socket reports cmd=3 arglen=32 = offsetof(struct ng_ksocket_accept, addr)=4 + sa_len=28 (sockaddr_in6) - exactly twice the 16-byte declared `struct sockaddr addr` (ng_ksocket.h:78-81). finish_accept bcopies the full sa_len into that fixed-typed field (ng_ksocket.c:1250-1252); the copy is in-bounds of the kmalloc'd response (allocated with OFFSETOF+sa_len), so this is the filed ABI/type-confusion hazard rather than memory corruption: any consumer type-punning the response with sizeof(struct sockaddr) (or copying sizeof(addr)) silently truncates 12+ bytes of address. Latent consumer-facing defect; no in-tree victim identified (ngctl's parse uses the generic sockaddr type).",
 "evidence": "run.log (ACCEPT resp cmd=3 arglen=32 vs sizeof(sockaddr)=16 + CONFIRMED line), kaccept.c",
 "kernel_refs": [
  "sys/netgraph7/ksocket/ng_ksocket.c:1250",
  "sys/netgraph7/ksocket/ng_ksocket.c:1252",
  "sys/netgraph7/ksocket/ng_ksocket.h:80"
 ],
 "poc_changes": "kaccept.c written fresh; note the listen flow requires an explicit NGM_KSOCKET_ACCEPT request to arm response_addr",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Sun Oct 25 20:46:48 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_NG7 x86_64 (harness kernel: X86_64_GENERIC + NETGRAPH7 stack)",
 "runtime_sec": 300,
 "guest_dirty": 0,
 "build_cmd": "gcc -O -o kaccept kaccept.c",
 "run_cmd": "./kaccept",
 "code_hash": "71516f11bea185f8ca709496d973d71098b45508d7ae56b14cab1536436055f8",
 "notes": "ng7 twin of DF-0512 as filed; in-bounds copy, declared-type confusion only.",
 "recommended_fix": "declare addr as struct sockaddr_storage (ABI bump) or document arglen-based consumption."
}