{
 "finding_id": "DF-3505",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "The spoof itself is reproduced; the claimed race-widening is refuted. (1) A ksocket node (ks0, inet/dgram/udp, bound) was created and held by a control-plane socket; a FOREIGN sender on a separate AF_NETGRAPH control socket then sent NGM_KSOCKET_INTERNAL_UPCALL (cookie 0x38309f8e, cmd 1) through the hook - v1 ng_ksocket rcvmsg (:848-854) performs no origin check whatsoever and invokes (*priv->so->so_upcall)(so, so->so_upcallarg, M_NOWAIT) out-of-band; 4,540,418 such foreign invocations were accepted in the hammer phase (flood_count, ksflood.c). The command is also exported in the public cmdlist. (2) HOWEVER the DF-0511-widening claim does not hold: both INTERNAL_UPCALL and NGM_SHUTDOWN are control messages and are dequeued strictly serially by the node's input queue, so an upcall flood cannot interleave with rmnode's so_upcall=NULL/soclose - 100 shutdown cycles under a 4.5M-send flood produced no panic and no anomaly. Net assessment: real missing-authorization (any hook-holding node can force out-of-band upcalls on the ksocket), no demonstrated memory-safety consequence on v1; hardening-grade.",
 "evidence": "run.log (ksflood output: bind, SPOOF-UPCALL acceptance, hammer done line with flood_count), ksflood.c, kshold.c",
 "kernel_refs": [
  "sys/netgraph/ksocket/ng_ksocket.c:848",
  "sys/netgraph/ksocket/ng_ksocket.c:853"
 ],
 "poc_changes": "written fresh (kshold.c graph holder via generic NGM_MKPEER/NGM_NAME; ksflood.c spoof+hammer)",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 300,
 "guest_dirty": 0,
 "build_cmd": "gcc -O -pthread -o ksflood ksflood.c; gcc -O -o kshold kshold.c",
 "run_cmd": "./kshold & ; ./ksflood 100",
 "code_hash": "d18e88c0ecb20bcc35a8e7729fc1d80b939e2d55ac3cc01be202531901312e06",
 "notes": "upcall invocation itself produces no user-visible output when the socket queue is empty - acceptance is proven by the successful sendmsg queueing against the live hook plus the rcvmsg code path having no error return for the command.",
 "recommended_fix": "remove NGM_KSOCKET_INTERNAL_UPCALL from the externally reachable cmdlist and verify the message was self-queued (retaddr check) before acting."
}