{
 "finding_id": "DF-3510",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "likely",
 "verdict": "Not reproduced: 150 teardown cycles (ngrace7.c: per cycle build socket-node+echo graph, associate a data socket, flood data sends from a thread while NGM_SHUTDOWN tears the node down) completed with no panic. Producer caveat, honestly noted: the ng7 data-socket send path rejected the flood in this environment (0 successful data sends across send()/sendto attempts - association/destination friction), so the ngd_send side of the race was not actually exercised; only the teardown side ran. The five unsynchronized priv->node/priv->datasock reads (ngc_send :310, ngd_send :443/:451, ngs_connect :864, ngs_disconnect :1028, ngs_rcvdata :978 area) against the mtx-protected shutdown remain code-certain; NULL-deref/node-UAF panic ceiling under a working producer. Filed on lock-usage asymmetry - unchanged by this run.",
 "evidence": "run.log (NGRACE7-DONE 150 cycles, 0 data sends, no panic), ngrace7.c",
 "kernel_refs": [
  "sys/netgraph7/socket/ng_socket.c:310",
  "sys/netgraph7/socket/ng_socket.c:443",
  "sys/netgraph7/socket/ng_socket.c:978",
  "sys/netgraph7/socket/ng_socket.c:1028"
 ],
 "poc_changes": "ngrace7.c written fresh (ng7 wire format); data-producer path could not be driven",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Sun Oct 25 20:46:48 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_NG7 x86_64 (harness kernel: X86_64_GENERIC + NETGRAPH7 stack)",
 "runtime_sec": 240,
 "guest_dirty": 0,
 "build_cmd": "gcc -O -pthread -o ngrace7 ngrace7.c",
 "run_cmd": "./ngrace7 150",
 "code_hash": "22719afb1b5e2a23833b5f4485ee72a6d074b19fcf1058b273b67c4825b07237",
 "notes": "recommend re-running with a kernel-side producer if pursued further.",
 "recommended_fix": "take priv->mtx around the bare reads and re-check node validity (as DF-0537 did for ng_connect_data)."
}