# DF-3505 - VERDICT

**status: reproduced | reproduced: 1 | impact: none | confidence: certain**

The spoof itself is reproduced; the claimed race-widening is refuted. (1) A ksocket node (ks0, inet/dgram/udp, bound) was created and held by a control-plane socket; a FOREIGN sender on a separate AF_NETGRAPH control socket then sent NGM_KSOCKET_INTERNAL_UPCALL (cookie 0x38309f8e, cmd 1) through the hook - v1 ng_ksocket rcvmsg (:848-854) performs no origin check whatsoever and invokes (*priv->so->so_upcall)(so, so->so_upcallarg, M_NOWAIT) out-of-band; 4,540,418 such foreign invocations were accepted in the hammer phase (flood_count, ksflood.c). The command is also exported in the public cmdlist. (2) HOWEVER the DF-0511-widening claim does not hold: both INTERNAL_UPCALL and NGM_SHUTDOWN are control messages and are dequeued strictly serially by the node's input queue, so an upcall flood cannot interleave with rmnode's so_upcall=NULL/soclose - 100 shutdown cycles under a 4.5M-send flood produced no panic and no anomaly. Net assessment: real missing-authorization (any hook-holding node can force out-of-band upcalls on the ksocket), no demonstrated memory-safety consequence on v1; hardening-grade.

## Kernel references
- sys/netgraph/ksocket/ng_ksocket.c:848
- sys/netgraph/ksocket/ng_ksocket.c:853

## Evidence
run.log (ksflood output: bind, SPOOF-UPCALL acceptance, hammer done line with flood_count), ksflood.c, kshold.c

## Recommended fix
remove NGM_KSOCKET_INTERNAL_UPCALL from the externally reachable cmdlist and verify the message was self-queued (retaddr check) before acting.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.