# DF-3507 - VERDICT

**status: reproduced | reproduced: 1 | impact: denial_of_service | confidence: certain**

Reproduced on the minimally-repaired harness module (constructor UB fix only - the stock module cannot even create a node, see DF-3506 pack). Sequence (fechg dump evidence): (1) tap0+tap1 added to fec0 - FECDMP shows tap0 ac_netgraph=0xfffff801179b28a0 == fec0's node. (2) A SECOND bundle fec1 was created and ADD_IFACE tap0 issued against it - the duplicate check at ng_fec.c:362-369 only scans THIS bundle's ports, so the add SUCCEEDED (rc=0) and tap0's ac_netgraph silently switched to fec1's node (0xfffff8011752ea00) while fec0's portlist still contains tap0: cross-bundle enslavement + silent RX ownership theft confirmed. (3) DEL_IFACE tap0 from fec1 - ng_fec_delport (:417-471) never clears the member's ac_netgraph: FECDMP shows tap0 still pointing at fec1's node after fec1 no longer lists it (stale ownership). The freed-node dereference arm (rmnode sets node->private=NULL at :1239 then frees; ng_fec_input:752-758 would deref the stale IFP2NG) is code-certain but could not be run: ng_fec_rmnode/stop paths additionally hit the INVARIANTS-only lwkt_serializer assert ('panic: assertion IS_SERIALIZED in lwkt_serialize_exit' from ng_fec_stop, captured in boot.log) and crash before creating the dangling state - on production (non-INVARIANTS) kernels the teardown runs and the stale pointer survives. Also note v1 ng_fec shares ac_netgraph with ng_ether(4) (if_arp.h:124), so fec+ng_ether coexistence silently steals RX exactly as filed. Root-gated misconfiguration-turned-DoS; no escalation path (fixed-offset reads of freed slab; NULL private in the benign case).

## Kernel references
- sys/netgraph/fec/ng_fec.c:362
- sys/netgraph/fec/ng_fec.c:379
- sys/netgraph/fec/ng_fec.c:417
- sys/netgraph/fec/ng_fec.c:752
- sys/netgraph/fec/ng_fec.c:1239

## Evidence
fec-sequence.log (three FECDMP snapshots: after adds / after cross-enslave / after DEL_IFACE showing tap0 ac_netgraph unchanged), fechg.c

## Recommended fix
in ng_fec_addport refuse interfaces whose ac_netgraph is already non-NULL (or whose if_input is already ng_fec_input); in ng_fec_delport clear ac_netgraph when it still points at this bundle's node.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.