{
 "finding_id": "DF-3509",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "likely",
 "verdict": "Not reproducible on this guest - doubly blocked before the race window can open. (1) On ANY kernel config the shipped ng_fec module cannot create a node (gcc-UB-eliminated NULL guard -> kfree(NULL) panic in ng_fec_get_unit, see DF-3506 pack - deterministic, non-INVARIANTS-gated). (2) Even on the constructor-repaired harness module, teardown cannot run on the INVARIANTS guest: ng_fec_rmnode -> ng_fec_stop hits 'panic: assertion IS_SERIALIZED((s)) failed in lwkt_serialize_exit' (captured in boot.log) BEFORE kfree(priv), so the tick-vs-rmnode window is never entered (on production kernels the teardown runs unserialized and the race is live). Code-certain analysis stands: ng_fec_tick re-arms itself while IFF_RUNNING (ng_fec.c:614-616), rmnode uses plain callout_stop via ng_fec_stop and never clears IFF_RUNNING (:1213-1240), and DFly callout_stop does not wait for an in-flight callout - a tick executing on another CPU re-arms onto &priv->fec_timeout and fires into freed memory. Narrow-window UAF, root-gated (node setup), panic ceiling.",
 "evidence": "boot.log (serializer panic in ng_fec_stop from rmnode - teardown blocked), fec-sequence.log, source :614-616/:1213-1240",
 "kernel_refs": [
  "sys/netgraph/fec/ng_fec.c:614",
  "sys/netgraph/fec/ng_fec.c:616",
  "sys/netgraph/fec/ng_fec.c:1222",
  "sys/netgraph/fec/ng_fec.c:1238"
 ],
 "poc_changes": "none (blocked; analysis only)",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "",
 "run_cmd": "n/a (unreachable on stock: ctor panic; on harness INVARIANTS: teardown serializer panic)",
 "code_hash": null,
 "notes": "reachability verdict: unreachable as shipped. Fix should include the constructor UB repair or the module stays dead.",
 "recommended_fix": "clear IFF_RUNNING and use callout_stop_sync/drain before kfree(priv) in ng_fec_rmnode; repair the get_unit bcopy UB so the module builds."
}