# DF-3510 - VERDICT

**status: not_reproduced | reproduced: 0 | impact: none | confidence: likely**

Not reproduced: 150 teardown cycles (ngrace7.c: per cycle build socket-node+echo graph, associate a data socket, flood data sends from a thread while NGM_SHUTDOWN tears the node down) completed with no panic. Producer caveat, honestly noted: the ng7 data-socket send path rejected the flood in this environment (0 successful data sends across send()/sendto attempts - association/destination friction), so the ngd_send side of the race was not actually exercised; only the teardown side ran. The five unsynchronized priv->node/priv->datasock reads (ngc_send :310, ngd_send :443/:451, ngs_connect :864, ngs_disconnect :1028, ngs_rcvdata :978 area) against the mtx-protected shutdown remain code-certain; NULL-deref/node-UAF panic ceiling under a working producer. Filed on lock-usage asymmetry - unchanged by this run.

## Kernel references
- sys/netgraph7/socket/ng_socket.c:310
- sys/netgraph7/socket/ng_socket.c:443
- sys/netgraph7/socket/ng_socket.c:978
- sys/netgraph7/socket/ng_socket.c:1028

## Evidence
run.log (NGRACE7-DONE 150 cycles, 0 data sends, no panic), ngrace7.c

## Recommended fix
take priv->mtx around the bare reads and re-check node validity (as DF-0537 did for ng_connect_data).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.